CVE-2026-81836
Received Received - Intake

OAuth Callback Cleartext Transmission in Roo-Code

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: VulDB

Description
A vulnerability was detected in RooCodeInc Roo-Code up to 3.51.1. This vulnerability affects unknown code of the file src/integrations/claude-code/oauth.ts of the component OAuth Callback. The manipulation results in cleartext transmission of sensitive information. The attack may be performed from remote. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The exploit is now public and may be used. Multiple isses were reported to the vendor beforehand. They explain, that "they all apply to Roo Code, a project we no longer support - the repository was archived a while ago, and we don't encourage anyone to use it." This vulnerability only affects products that are no longer supported by the maintainer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-08-28
AI Q&A
2026-08-28
EPSS Evaluated
N/A
NVD
CVE-2026-81836
EUVD
EUVD-2026-67279

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
roocodeinc roo-code to 3.51.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-310 Cryptographic Issues
CWE-319 The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves RooCodeInc Roo-Code up to version 3.51.1 transmitting sensitive OAuth authorization codes in cleartext over an insecure HTTP callback URL instead of HTTPS. This allows attackers on the same network to intercept these credentials and potentially gain full control over the victim's Roo-Code account.

Detection Guidance

To detect this vulnerability, monitor network traffic for cleartext OAuth callback requests to http://localhost:54545/callback. Use packet sniffing tools like tcpdump or Wireshark to inspect HTTP traffic for sensitive authorization codes. Check application logs for callback URLs containing unencrypted tokens.

Impact Analysis

If you use Roo-Code on a shared network like public WiFi or a corporate environment, attackers could intercept your OAuth authorization codes. This could lead to unauthorized access to your Roo-Code account, allowing data theft, code modification, or persistent access via refresh tokens.

Compliance Impact

This vulnerability likely violates data protection requirements under GDPR and HIPAA due to the cleartext transmission of sensitive credentials. It exposes personal and potentially health-related data to interception, failing to meet encryption and secure transmission standards required by these regulations.

Mitigation Strategies

Immediately disable Roo-Code if in use, as it is no longer supported. If continued use is unavoidable, switch the OAuth callback URL to HTTPS, implement PKCE for additional security, and enforce short-lived authorization codes. Isolate affected systems from shared networks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81836. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart