Threats tagged 'brew-mcpm-cve-2026-44681'

CVE-2026-44681 is an open redirect vulnerability in Authlib's OpenIDImplicitGrant and OpenIDHybridGrant authorization endpoints. An attacker can cause the authorization server to issue an HTTP 302 redirect to an arbitrary URL by submitting an authorization request that omits the required 'openid' scope. This occurs because the scope validation error redirects to an unvalidated redirect_uri supplied by the attacker. The flaw affects Authlib versions from 2.1.0 up to but not including 2.14.0_4 and is fixed in version 2.14.0_4. The vulnerability enables phishing attacks leveraging the trusted authorization server domain but does not leak tokens or codes directly.