Vulnerability Description
Coroot's unauthenticated MCP OAuth dynamic client registration endpoint accepts any syntactically valid redirect URI without validation, allowing attackers to register clients pointing to attacker-controlled hosts. Attackers can send authorization URLs to signed-in users, capture their authorization codes upon consent approval, and exchange them for access tokens to hijack MCP sessions.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/coroot/coroot
- https://github.com/coroot/coroot/blob/v1.24.5/api/mcp_oauth.go
- https://github.com/coroot/coroot/issues/929
- https://www.vulncheck.com/advisories/coroot-1.20.2-through-1.24.5-unvalidated-re
- https://github.com/coroot/coroot/issues/929
FAQ
What is CVE-2026-79786?
CVE-2026-79786 is a vulnerability with a CVSS score of 7.1 (HIGH). Coroot's unauthenticated MCP OAuth dynamic client registration endpoint accepts any syntactically valid redirect URI without validation, allowing attackers to register clients pointing to attacker-con...
How severe is CVE-2026-79786?
CVE-2026-79786 has been rated HIGH with a CVSS base score of 7.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-79786?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.