Threats tagged 'brew-mcp-atlassian-cve-2026-28802'

A vulnerability in the Authlib library versions >=0.11.11 and <0.13.1 allows bypassing JWT signature verification when the token header specifies 'alg: none' with an empty signature. This flaw was introduced in versions after 1.5.2 and persists through 1.6.5, causing malicious tokens to be accepted as valid without proper signature checks. The issue can lead to authentication bypass, privilege escalation, and unauthorized access. A fix is available in version 0.13.1.