Threats tagged 'brew-mcp-atlassian-cve-2026-49852'

The joserfc library's JWT decoding function accepts attacker-forged HMAC-signed tokens when the verification key is empty or None. This occurs because the library issues only a warning for keys shorter than 14 bytes but does not reject zero-length keys, allowing attackers to forge tokens without secret knowledge. This vulnerability affects joserfc versions up to and including 1.6.7, with no patched release available at the time of this report.