Threats tagged 'pysec-2026-4354'

Authlib versions from 0.13 up to but not including 1.8.0 contain a vulnerability in the is_secure_transport() function, which uses a textual prefix comparison for loopback HTTP exemptions. This flaw allows an attacker who can supply a URL to certain OIDC operations to bypass the TLS requirement and cause cleartext redirection or acceptance of cleartext endpoints. The vulnerability does not bypass redirect URI exact matching and does not enable token forgery or user authentication bypass. The issue is fixed in version 1.8.0.