Threats tagged 'brew-mcp-atlassian-cve-2026-28498'

Authlib Python library versions from 0.11.11 up to but not including 0.21.0 contain a critical vulnerability in the OpenID Connect (OIDC) ID Token validation process. The internal hash verification function incorrectly returns success when encountering unsupported cryptographic algorithms, allowing attackers to bypass integrity checks on the Access Token Hash (at_hash) and Authorization Code Hash (c_hash) claims. This fail-open behavior violates OIDC and JWT specifications, enabling token substitution attacks in Hybrid or Implicit OIDC flows. The vulnerability is fixed in version 0.21.0.