OpenClaude's MCP OAuth Callback: State Check Bypass via error Param Leads to DoS

CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.

No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.

OpenClaude is an open-source coding-agent command line interface for cloud and local model providers. Prior to version 0.5.1, the OpenClaude MCP authentication flow starts a temporary local HTTP server to handle OAuth callbacks. To prevent CSRF attacks, the server validates a state parameter against an internally stored value. However, due to a logic flaw in the order of conditionals, an attacker can completely bypass this check and force the server to shut down — without knowing the state value at all. This issue has been patched in version 0.5.1.

Source published

2 Jun 2026 15:38:53 UTC

Source modified

2 Jun 2026 17:40:55 UTC

Saved here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS 3.1 · 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

OpenClaude is an open-source coding-agent command line interface for cloud and local model providers. Prior to version 0.5.1, the OpenClaude MCP authentication flow starts a temporary local HTTP server to handle OAuth callbacks. To prevent CSRF attacks, the server validates a state parameter against an internally stored value. However, due to a logic flaw in the order of conditionals, an attacker can completely bypass this check and force the server to shut down — without knowing the state value at all. This issue has been patched in version 0.5.1.

Source published

Jun 2, 2026, 3:38:53 PM (timezone not stated)

Source modified

Jun 2, 2026, 5:40:55 PM (timezone not stated)

Saved here

15 Nov 2026 13:03:26 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

Source: euvd · ENISA EUVD · source terms and attribution apply. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

EUVD CVSS 3.1 · 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

OpenClaude is an open-source coding-agent command line interface for cloud and local model providers. Prior to version 0.5.1, the OpenClaude MCP authentication flow starts a temporary local HTTP server to handle OAuth callbacks. To prevent CSRF attacks, the server validates a state parameter against an internally stored value. However, due to a logic flaw in the order of conditionals, an attacker can completely bypass this check and force the server to shut down — without knowing the state value at all. This issue has been patched in version 0.5.1.

Source published

2 Jun 2026 17:16:31 UTC

Source modified

22 Jul 2026 19:10:00 UTC

Saved here

25 Oct 2026 10:17:10 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

Source: nvd · NIST NVD usage terms; underlying source attribution retained. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS 3.1 · [email protected] · Secondary · 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

# OAuth State Validation Bypass via `error` Parameter Causes Local Server DoS in MCP Auth Callback --- ## Description The OpenClaude MCP authentication flow starts a temporary local HTTP server to handle OAuth callbacks. To prevent CSRF attacks, the server validates a `state` parameter against an internally stored value. However, due to a logic flaw in the order of conditionals, an attacker can completely bypass this check and force the server to shut down — without knowing the `state` value at all. The vulnerable code looks like this: ```typescript if (!error && state !== oauthState) { rejectOnce(new Error('OAuth state mismatch - possible CSRF attack')) return } if (error) { cleanup() rejectOnce(new Error(errorMessage)) return } ``` When a request arrives with an `error` query parameter (e.g., `?error=anything`), the first condition becomes `false` because `!error` evaluates to `false`. This means the CSRF check is **never reached**. Execution falls through to the second block, where `cleanup()` is called — shutting down the local server and terminating the user's active authentication session. The attacker does not need to know the `state` value. Any request containing an `error` parameter is enough to trigger the shutdown. --- ## Impact - The user's OAuth flow is silently terminated mid-session - The local callback server is shut down (Denial of Service) - Can be triggered remotely via a malicious web page using a cross-origin request (CSRF) - No authentication or prior knowledge of the `state` value is required --- ## Steps to Reproduce Save the following as `poc.js` and run with Node.js: ```javascript import { createServer } from 'http'; import { parse } from 'url'; const expectedState = "secure_state_abc123"; const server = createServer((req, res) => { const parsedUrl = parse(req.url || '', true); const { pathname, query } = parsedUrl; const { state, error } = query; if (pathname === '/callback') { // Vulnerable: error param causes state check to be skipped entirely if (!error && state !== expectedState) { res.writeHead(400); res.end('State mismatch'); console.log('[-] CSRF attempt blocked.'); return; } if (error) { res.writeHead(200); res.end(`Error: ${error}`); console.log(`[!] Server shutting down. Triggered by: ${error}`); server.close(); return; } } }); server.listen(12345, '127.0.0.1', () => { console.log('Listening on http://127.0.0.1:12345'); }); ``` **Terminal 1 — start the server:** ```bash node poc.js ``` **Terminal 2 — trigger the bypass:** ```bash curl "http://127.0.0.1:12345/callback?error=triggered" ``` **Expected result:** Server shuts down immediately. The `state` value was never checked. --- ## Root Cause The CSRF protection is conditioned on `!error`, meaning it is silently disabled whenever an `error` parameter is present. The two checks need to be decoupled — state validation must happen first, independently of any other parameters. --- ## Fix Move the `state` check before the `error` check, and remove the dependency on `!error`: ```typescript // Fixed if (state !== oauthState) { cleanup() rejectOnce(new Error('OAuth state mismatch - possible CSRF attack')) return } if (error) { cleanup() rejectOnce(new Error(errorMessage)) return } ``` With this change, any request — whether it contains an `error` parameter or not — must first pass the state validation before any further processing occurs. --- Credit: Xanlar Agamalizade

Source published

12 May 2026 15:34:30 UTC

Source modified

10 Sep 2026 03:51:05 UTC

Saved here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · GitHub Advisory Database · CC-BY-4.0. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Publisher rating · MODERATE