CVE-2026-79786: Coroot 1.20.2 through 1.24.5 Unvalidated Redirect URI in MCP OAuth Client Registration
Coroot's unauthenticated MCP OAuth dynamic client registration endpoint accepts any syntactically valid redirect URI without validation, allowing attackers to register clients pointing to attacker-controlled hosts. Attackers can send authorization URLs to signed-in users, capture their authorization codes upon consent approval, and exchange them for access tokens to hijack MCP sessions.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Coroot versions 1.20.2 through 1.24.5 are affected where the MCP OAuth dynamic client registration endpoint is available. The endpoint is unauthenticated, so exploitation does not require an existing Coroot account.
What does an attacker need to exploit this issue?
An attacker can register an OAuth client with a syntactically valid redirect URI pointing to an attacker-controlled host, then induce a signed-in user to visit an authorization URL and approve consent. Successful exploitation requires user interaction and consent approval.
What can an attacker obtain after successful exploitation?
The attacker can receive the authorization code at the attacker-controlled redirect URI and exchange it for an access token. This can enable hijacking of the affected user's MCP session.