Description

Coroot's unauthenticated MCP OAuth dynamic client registration endpoint accepts any syntactically valid redirect URI without validation, allowing attackers to register clients pointing to attacker-controlled hosts. Attackers can send authorization URLs to signed-in users, capture their authorization codes upon consent approval, and exchange them for access tokens to hijack MCP sessions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-25T19:16:54.750Z",
  "pubdate": "2026-08-25T19:16:54.750Z",
  "executiveSummary": "The Coroot MCP (Model Context Protocol) component contains a critical vulnerability in its dynamic client registration endpoint. The endpoint fails to perform validation on redirect URI parameters, allowing unauthenticated attackers to register arbitrary OAuth clients.\nThis vulnerability leads to unauthorized session hijacking. By registering a malicious client, an attacker can craft authorization requests directed at authenticated Coroot users. When a victim grants consent, the authorization code is inadvertently disclosed to the attacker-controlled redirect URI.\nThe attacker can subsequently exchange this stolen code for a valid access token, effectively gaining unauthorized access to the victim's MCP session. This poses a severe risk to data integrity and session security, as it bypasses standard OAuth trust boundaries by exploiting the lack of origin verification during client registration.\nThe vulnerability is accessible to unauthenticated remote attackers. Exploitation requires minimal interaction from the victim, specifically inducing them to navigate to a malicious authorization URL. Given the nature of OAuth flows, this vulnerability provides attackers with full control over the hijacked session until the token is revoked or expires.",
  "technicalDetails": "The vulnerability resides within the Coroot MCP dynamic client registration mechanism. When a client initiates a registration request, the application interface fails to verify the integrity or destination of the provided redirect_uri. Because the endpoint is unauthenticated, any entity can register a new client profile by submitting a payload containing a URI pointing to a domain under the attacker's control.\nThe attack flow proceeds as follows: First, the attacker registers a rogue client with the Coroot MCP instance, specifying an attacker-controlled listener endpoint as the redirect_uri. Second, the attacker generates an authorization URL associated with the newly registered (malicious) client ID. Third, the attacker social-engineers a logged-in Coroot user into clicking the authorization link. Fourth, upon clicking, the user is presented with the standard OAuth consent screen provided by Coroot. Once the user approves the consent request, the Coroot authorization server transmits an authorization code to the attacker's server via the specified malicious redirect_uri.\nFinally, the attacker intercepts the authorization code and completes the OAuth exchange by calling the token endpoint. By supplying the client ID and the captured authorization code, the attacker receives a valid access token for the victim's session. This allows the attacker to impersonate the victim within the context of the MCP integration, facilitating unauthorized access to sensitive data or actions permitted by the victim's session permissions.\nThe root cause is the lack of strict allow-listing for registered redirect URIs. By permitting any syntactically valid URI, the system trusts user-supplied input during the registration process without validating that the domain belongs to the intended client. This bypasses the security intent of the OAuth protocol, which relies on pre-registered callback locations to prevent code leakage to arbitrary third parties. The vulnerability is present in the MCP integration logic of Coroot and can be exploited by any network-adjacent or remote actor capable of reaching the instance's registration endpoint."
}