Homepage

Improper Verification of Cryptographic Signature The advisory has been revoked - it doesn't affect any version of package satellite/foreman-mcp-server-rhel9  (opens in a new tab)

Threat Intelligence

EPSS
0.55% (42nd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL7-SATELLITEFOREMANMCPSERVERRHEL9-15690405
  • published19 Mar 2026
  • disclosed16 Mar 2026
Report a new vulnerability Found a mistake?

Introduced: 16 Mar 2026

CVE-2026-27962  (opens in a new tab)
CWE-347  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:7.

NVD Description

Note: Versions mentioned in the description apply only to the upstream satellite/foreman-mcp-server-rhel9 package and not the satellite/foreman-mcp-server-rhel9 package as distributed by RHEL.

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a JWK Header Injection vulnerability in authlib's JWS implementation allows an unauthenticated attacker to forge arbitrary JWT tokens that pass signature verification. When key=None is passed to any JWS deserialization function, the library extracts and uses the cryptographic key embedded in the attacker-controlled JWT jwk header field. An attacker can sign a token with their own private key, embed the matching public key in the header, and have the server accept the forged token as cryptographically valid — bypassing authentication and authorization entirely. This issue has been patched in version 1.6.9.