Vulnerability · Published Aug 25, 2026 · Assigned by VulnCheck
CVE-2026-79786Coroot 1.20.2 through 1.24.5 Unvalidated Redirect URI in MCP OAuth Client Registration
High 7.1
In plain English
A high-severity open redirect in coroot from coroot. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).
Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.4%top 66.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Coroot's unauthenticated MCP OAuth dynamic client registration endpoint accepts any syntactically valid redirect URI without validation, allowing attackers to register clients pointing to attacker-controlled hosts. Attackers can send authorization URLs to signed-in users, capture their authorization codes upon consent approval, and exchange them for access tokens to hijack MCP sessions.
Affected products (as reported)
Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
References
- https://github.com/coroot/coroot product
- https://github.com/coroot/coroot/issues/929 issue-tracking
- https://github.com/coroot/coroot/blob/v1.24.5/api/mcp_oauth.go technical-description
- VulnCheck Advisory: Coroot 1.20.2 through 1.24.5 Unvalidated Redirect URI in MCP OAuth Client Registration third-party-advisory