CVE-2026-79786: Coroot MCP OAuth Auth Bypass Vulnerability

CVE-2026-79786 Overview

Coroot contains an open redirect vulnerability [CWE-601] in its Model Context Protocol (MCP) OAuth dynamic client registration endpoint. The unauthenticated endpoint accepts any syntactically valid redirect URI without validating the destination host. Attackers can register OAuth clients pointing to attacker-controlled infrastructure, then send crafted authorization URLs to authenticated Coroot users. When a signed-in user approves consent, the attacker captures the authorization code and exchanges it for an access token. This hands the attacker a valid MCP session and access to Coroot data the victim can reach. The flaw affects Coroot versions 1.20.2 through 1.24.5, according to the VulnCheck advisory.

Critical Impact
Remote attackers can hijack authenticated Coroot MCP sessions by tricking users into approving OAuth consent, gaining access to observability data without credentials.

Affected Products

Coroot 1.20.2 through 1.24.5
Coroot MCP OAuth client registration endpoint (api/mcp_oauth.go)
Deployments exposing the Coroot MCP OAuth endpoint to untrusted networks

Discovery Timeline

2026-08-25 - CVE-2026-79786 published to the National Vulnerability Database
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-79786

Vulnerability Analysis

Coroot exposes an OAuth 2.0 dynamic client registration endpoint to support the Model Context Protocol (MCP). The endpoint permits unauthenticated clients to register with an arbitrary redirect_uri. According to the VulnCheck advisory, the implementation checks only that the URI is syntactically valid. It does not enforce an allowlist, verify the host, or restrict the scheme to trusted destinations.

An attacker registers a client whose redirect target points to a server they control. They then craft an authorization URL referencing that client and deliver it to an authenticated Coroot user through phishing, chat, or another channel. When the victim clicks and approves the OAuth consent prompt, Coroot issues an authorization code and redirects the browser to the attacker's endpoint. The attacker exchanges the code for an access token and assumes the victim's MCP session.

Root Cause

The root cause is missing validation of the redirect_uri parameter during dynamic client registration in api/mcp_oauth.go. OAuth 2.0 dynamic client registration is designed to be paired with strict redirect URI policies. Coroot registers arbitrary attacker-supplied hosts, breaking the assumption that authorization codes are only ever delivered to trusted client endpoints.

Attack Vector

Exploitation requires network access to the Coroot MCP OAuth endpoint and a single victim interaction (consent approval). The attacker performs these steps: register a malicious OAuth client through the unauthenticated endpoint, generate an authorization URL referencing that client, deliver the link to a signed-in Coroot user, receive the authorization code at the controlled redirect target, and exchange the code for an access token via the token endpoint. The attacker then interacts with the MCP session as the victim.

No verified exploit code is publicly available. See the VulnCheck Security Advisory and the Coroot OAuth source for implementation details.

Detection Methods for CVE-2026-79786

Indicators of Compromise

Dynamic client registrations at /mcp/oauth (or equivalent MCP OAuth path) with redirect_uri values pointing to external or non-corporate hosts.
OAuth authorization requests where the client_id maps to a recently registered client with an untrusted redirect target.
Successful token exchanges followed by MCP API activity originating from unusual IP addresses or user agents.
User reports of unexpected consent prompts after clicking Coroot-related links.

Detection Strategies

Audit Coroot logs for POST requests to the MCP OAuth client registration endpoint and enumerate all registered redirect_uri values.
Alert on any registered redirect URI whose host is not in an approved internal allowlist.
Correlate authorization code issuance with subsequent MCP session activity to identify sessions initiated through suspicious clients.

Monitoring Recommendations

Forward Coroot application logs and reverse-proxy access logs to a central SIEM for OAuth endpoint analysis.
Track baseline volumes of client registrations and alert on spikes or registrations from new source IPs.
Monitor outbound traffic from user browsers to unexpected hosts immediately after Coroot authorization events.

How to Mitigate CVE-2026-79786

Immediate Actions Required

Restrict network access to the Coroot MCP OAuth endpoint using firewall rules, reverse-proxy ACLs, or authentication in front of the service.
Enumerate all registered MCP OAuth clients and revoke any with untrusted or externally hosted redirect_uri values.
Revoke active MCP access tokens and require users to re-authenticate to invalidate any hijacked sessions.
Track upstream fixes via Coroot Issue #929 and apply patched releases when available.

Patch Information

The vulnerability affects Coroot versions 1.20.2 through 1.24.5 per the VulnCheck advisory. Review the Coroot repository and Issue #929 for the current status of a fixed release. Upgrade to a version that enforces redirect_uri validation once published.

Workarounds

Disable the MCP OAuth dynamic client registration endpoint if MCP integration is not required.
Place Coroot behind a reverse proxy that enforces authentication and rejects unauthenticated client registration requests.
Educate users to reject unexpected Coroot consent prompts and to verify that authorization requests originate from known integrations.

bash

# Example nginx snippet restricting the MCP OAuth registration endpoint
# to an internal management CIDR until an upstream patch is applied.
location /mcp/oauth/register {
    allow 10.0.0.0/8;
    deny  all;
    proxy_pass http://coroot_upstream;
}