Threats tagged 'brew-mcp-atlassian-cve-2026-114616'

Authlib versions up to 1.7.2 accept an empty HMAC key for JWS/JWT HS256/HS384/HS512 signature verification, allowing attackers to forge tokens that pass signature checks. This occurs because empty keys produce deterministic digests that anyone can reproduce, enabling token forgery and authentication bypass in OAuth 2.0 and OIDC implementations using Authlib. The vulnerability is confirmed in the v1.7.2 release and remains in the current main branch. A fix is available in version 0.23.1_2.