CVE-2026-79786CWE-601

CVE-2026-79786

High · published August 25, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
18.5
In the wild
Unconfirmed
What it is

Coroot's unauthenticated MCP OAuth dynamic client registration endpoint accepts any syntactically valid redirect URI without validation, allowing attackers to register clients pointing to attacker-controlled hosts. Attackers can send authorization URLs to signed-in users, capture their authorization codes upon consent approval, and exchange them for access tokens to hijack MCP sessions.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
CVSS v4.0
7.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00272 · 18.5th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2026-08-25T23:16Z
References (5)
https://github.com/coroot/coroot · [email protected]https://github.com/coroot/coroot/blob/v1.24.5/api/mcp_oauth.go · [email protected]https://github.com/coroot/coroot/issues/929 · [email protected]https://www.vulncheck.com/advisories/coroot-1.20.2-through-1.24.5-unvalidated-redirect-uri-in-mcp-oauth-client-registration · [email protected]https://github.com/coroot/coroot/issues/929 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 27 AUG 06:46Z
    EPSS moved — → 0%
    epss
  • 25 AUG 18:23Z
    Coroot 1.20.2 through 1.24.5 Unvalidated Redirect URI in MCP OAuth Client Registration
    cvelistv5