Threats tagged 'brew-omnara-cve-2026-114615'

CVE-2026-114615 is a vulnerability in Omnara's authlib library where an incomplete fix for algorithm confusion allows an attacker to forge HMAC tokens using asymmetric public keys with certain leading bytes. The guard that prevents using asymmetric keys as HMAC secrets only checks if the key bytes start exactly with known PEM headers, but the loader accepts keys with leading whitespace, newlines, or comments. This discrepancy enables an attacker with only the issuer's public key to create HS256 tokens that the system accepts as authentic. The issue affects versions 1.5.2 and later, including the latest 1.8.0 release as of 2026-08-30.