Threats tagged 'brew-mcp-atlassian-cve-2026-116672'

CVE-2026-116672 is a vulnerability in Authlib's implementation of the OAuth 2.0 Dynamic Client Registration Management Protocol (RFC 7592). The provided example code for the ClientConfigurationEndpoint fails to enforce binding between the registration_access_token and the client being accessed, allowing an attacker with any valid token and knowledge of a client_id to bypass authorization and modify or delete client registrations. This flaw arises because the example implementations do not check that the token presented belongs to the client identified in the request. The issue affects versions >=0.11.11 and <0.23.1_2 of the mcp-atlassian product and is fixed in version 0.23.1_2.