Threats tagged 'brew-mcp-atlassian-cve-2026-114617'

Authlib versions prior to 0.23.1_2 contain a vulnerability in the OpenID ID token parsing logic where the nonce validation can be bypassed if the ID token includes a nonce_supported claim set to boolean false. This causes the nonce check to be skipped, allowing replay of a valid signed ID token into an attacker-controlled session, authenticating the attacker as the victim. The issue affects implicit and hybrid flows and direct calls to parse_id_token(), but not the authorization code flow. A fix is available in version 0.23.1_2.