Threats tagged 'brew-omnara-cve-2026-116672'

CVE-2026-116672 affects Omnara's implementation of Authlib's RFC 7592 dynamic client registration management endpoint. The provided example code for client authentication and permission checking omits a critical step: binding the registration_access_token to the specific client being accessed. This omission allows an attacker possessing any valid registration_access_token and knowledge of a client_id to bypass authorization and access or modify other clients' registrations. The vulnerability arises because the example implementations do not verify that the token presented belongs to the client identified in the request, violating the protocol's security model.