Coroot MCP OAuth Redirect URI Spoofing Vulnerability

Executive Summary

This vulnerability involves Coroot's unauthenticated MCP OAuth dynamic client registration endpoint. It accepts any syntactically valid redirect URI without proper validation, allowing attackers to register malicious clients pointing to attacker-controlled hosts. Attackers can then send authorization URLs to users, capture their authorization codes upon approval, and exchange these codes for access tokens to hijack MCP sessions.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for unauthorized OAuth client registrations to the /oauth/register endpoint. Check Coroot logs for suspicious redirect URIs pointing to external domains. Inspect authorization codes exchanged for tokens without proper PKCE validation. Use tools like curl to test the endpoint: curl -X POST http://<coroot-server>/oauth/register -d '{"redirect_uris":["http://attacker.com"]}' to verify if arbitrary URIs are accepted.

Useful 0 Not Useful 0

Impact Analysis

If you use Coroot's MCP OAuth service, attackers could hijack your MCP sessions by tricking you into approving authorization requests. This could lead to unauthorized access to your data or actions performed on your behalf through the hijacked session.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. Organizations using Coroot's MCP OAuth service may face compliance violations due to insufficient authorization code validation, potentially resulting in data breaches and regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Disable or restrict access to Coroot's unauthenticated MCP OAuth dynamic client registration endpoint. Ensure all redirect URIs are strictly validated against a predefined allowlist. Review and revoke any unauthorized client registrations.

Useful 0 Not Useful 0