CVE-2026-79786 Coroot 1.20.2 through 1.24.5 Unvalidated Redirect URI in MCP OAuth Client Registration
Attackers can hijack MCP sessions by registering malicious redirect URIs to capture authorization codes from signed-in users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-79786?
CVE-2026-79786 is a high-severity vulnerability in coroot, published on 25 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Coroot's unauthenticated MCP OAuth dynamic client registration endpoint accepts any syntactically valid redirect URI without validation, allowing attackers to register clients pointing to attacker-controlled hosts. Attackers can send authorization URLs to signed-in users, capture their authorization codes upon consent approval, and exchange them for access tokens to hijack MCP sessions.
Weakness: CWE-601
Which versions are affected by CVE-2026-79786?
How do I fix CVE-2026-79786?
No fix has been published for CVE-2026-79786 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-79786 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-79786 exists.
Sources
Also known as GHSA-g3gf-mwj7-2hc4.