Threats tagged 'brew-mcp-atlassian-cve-2026-28490'

A cryptographic padding oracle vulnerability exists in the Authlib Python library's implementation of the JSON Web Encryption (JWE) RSA1_5 key management algorithm. Authlib disables the Bleichenbacher mitigation implemented by the underlying cryptography library by raising a distinct exception on invalid padding, creating a reliable exception oracle. This vulnerability is active by default in Authlib versions before 0.21.0 and can be exploited via distinguishable error responses in common Python web frameworks. A fix is available in Authlib version 0.21.0.