CVE-2026-108865CWE-287

CVE-2026-108865

High · published October 11, 2026

CVSS v3.1
8.2
EPSS
0%
Percentile
24.2
In the wild
Unconfirmed
What it is

AmoyLab Unla through 0.10.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid access tokens because the OAuth2 server never authenticates a resource owner. Attackers can register a client, request a code from /authorize, and exchange it at /token to access OAuth2-protected MCP prefixes, proxied upstream APIs and injected credentials.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
8.8 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00324 · 24.2th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-10-11T18:17Z
References (5)
https://github.com/AmoyLab/Unla · [email protected]https://github.com/AmoyLab/Unla/blob/v0.10.0/internal/auth/oauth.go#L86-L147 · [email protected]https://github.com/AmoyLab/Unla/blob/v0.10.0/internal/core/server.go#L229-L261 · [email protected]https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/amoylab-unla-oauth-self-issued-token-authz · [email protected]https://www.vulncheck.com/advisories/amoylab-unla-through-0.10.0-oauth2-authentication-bypass-via-authorize · [email protected]
EPSS history
Timeline
  • 13 OCT 03:28Z
    EPSS moved — → 0%
    epss
  • 11 OCT 13:26Z
    AmoyLab Unla through 0.10.0 OAuth2 Authentication Bypass via /authorize
    cvelistv5
  • 11 OCT 13:26Z
    AmoyLab Unla through 0.10.0 OAuth2 Authentication Bypass via /authorize
    cvelistv5