What’s Vulnerable › Vulnerabilities

CVE-2026-79786: Coroot 1.20.2 through 1.24.5 Unvalidated Redirect URI in MCP OAuth Client Registration

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-25 · updated 2026-09-23
• Weakness: CWE-601

Description

Coroot's unauthenticated MCP OAuth dynamic client registration endpoint accepts any syntactically valid redirect URI without validation, allowing attackers to register clients pointing to attacker-controlled hosts. Attackers can send authorization URLs to signed-in users, capture their authorization codes upon consent approval, and exchange them for access tokens to hijack MCP sessions.

Affected products

• coroot: from 1.20.2 through 1.24.5

References

• https://github.com/coroot/coroot
• https://github.com/coroot/coroot/blob/v1.24.5/api/mcp_oauth.go
• https://github.com/coroot/coroot/issues/929
• https://www.vulncheck.com/advisories/coroot-1.20.2-through-1.24.5-unvalidated-redirect-uri-in-mcp-oauth-client-registration
• https://github.com/coroot/coroot/issues/929

Get alerted when CVE-2026-79786 or the next vulnerability affects your stack