CVE-2026-79786 - Coroot 1.20.2 through 1.24.5 Unvalidated Redirect URI in MCP OAuth Client Registration

Back Back to CVE browser

HIGH

Coroot 1.20.2 through 1.24.5 Unvalidated Redirect URI in MCP OAuth Client Registration

Published Aug 25, 2026

7.0

HIGH

CVSS 4.0

EPSS 0.27%

Description

Coroot's unauthenticated MCP OAuth dynamic client registration endpoint accepts any syntactically valid redirect URI without validation, allowing attackers to register clients pointing to attacker-controlled hosts. Attackers can send authorization URLs to signed-in users, capture their authorization codes upon consent approval, and exchange them for access tokens to hijack MCP sessions.

Affected products

Vendor Coroot Product Coroot Default
unaffected
- Version
  1.20.2
  Status
  affected
  Constraints
  <=1.24.5

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Coroot

unaffected

Version	Status	Constraints
1.20.2	affected	<=1.24.5

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-601

Open Redirect

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-65698
Advisory
https://github.com/coroot/coroot
product
https://github.com/coroot/coroot/blob/v1.24.5/api/mcp_oauth.go
technical-description
https://github.com/coroot/coroot/issues/929
exploitissue-tracking
https://www.vulncheck.com/advisories/coroot-1.20.2-through-1.24.5-unvalidated-redirect-uri-in-mcp-oauth-client-registration
third-party-advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-65698		Advisory
https://github.com/coroot/coroot		product
https://github.com/coroot/coroot/blob/v1.24.5/api/mcp_oauth.go		technical-description
https://github.com/coroot/coroot/issues/929		exploitissue-tracking
https://www.vulncheck.com/advisories/coroot-1.20.2-through-1.24.5-unvalidated-redirect-uri-in-mcp-oauth-client-registration		third-party-advisory