Threats tagged 'brew-mcp-atlassian-cve-2026-114619'

Authlib's OpenID Connect implicit grant implementation contains a vulnerability where the raw scope parameter from the client request is checked instead of the filtered allowed scope before issuing ID tokens. This allows a registered OAuth client that is not permitted the 'openid' scope but allowed other scopes like 'profile' to obtain signed ID tokens if the user consents. The issue affects deployments using the OpenID implicit grant and clients permitted 'id_token' response types but excluded from the 'openid' scope. The vulnerability does not affect authorization code flow deployments or setups where clients allowed 'id_token' response types are also allowed the 'openid' scope.