Threats tagged 'brew-mcp-atlassian-cve-2026-44681'

Authlib's OpenID Connect Implicit and Hybrid authorization endpoints contain an unauthenticated open redirect vulnerability. An attacker can craft an authorization request omitting the 'openid' scope, causing the server to redirect users to an attacker-controlled URL. This occurs because the scope validation error redirects using an unvalidated redirect_uri parameter. The flaw affects Authlib versions from 0.11.11 up to but not including 0.21.1_4 and has been fixed in 0.21.1_4. The vulnerability enables phishing and credential harvesting by leveraging the trusted authorization server's domain in the redirect.