CVE-2026-90712: Gitlawb openclaude DOS Vulnerability

CVE-2026-90712 Overview

CVE-2026-90712 affects Gitlawb openclaude versions up to 0.30.0. The vulnerability resides in the waitForCallback function within src/services/api/xaiOAuthCallback.ts, part of the xAI OAuth Callback Handler component. Manipulation of the Error argument leads to a denial-of-service condition [CWE-404: Improper Resource Shutdown or Release]. The flaw is remotely reachable and requires user interaction to trigger. A public exploit reference exists through VulDB, and the project maintainers have not responded to the upstream issue report at the time of publication.

Critical Impact
Remote attackers can trigger a denial-of-service condition in the OAuth callback handler by manipulating the Error argument, disrupting authentication flows for openclaude deployments.

Affected Products

Gitlawb openclaude versions up to and including 0.30.0
Component: xAI OAuth Callback Handler (src/services/api/xaiOAuthCallback.ts)
Function: waitForCallback

Discovery Timeline

2026-09-14 - CVE-2026-90712 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90712

Vulnerability Analysis

The vulnerability affects the OAuth callback flow used to authenticate xAI service integrations within openclaude. When the callback handler processes the Error parameter passed to waitForCallback, insufficient resource management allows an attacker to cause the handler to terminate improperly or exhaust its execution context. This breaks the authentication handshake and can render the OAuth service path unavailable to legitimate users. Because the callback handler is network-reachable, an attacker only needs to induce a victim to interact with a crafted authentication link to trigger the condition.

Root Cause

The root cause is improper resource shutdown or release [CWE-404] in waitForCallback. The function does not correctly reclaim or reset state when the Error argument is manipulated with unexpected values. This leaves the OAuth callback resource in a degraded state and disrupts subsequent request handling.

Attack Vector

Exploitation occurs over the network and requires user interaction, typically the victim following an OAuth callback URL controlled or influenced by the attacker. The attacker crafts the Error argument passed to the xAI OAuth callback endpoint so that waitForCallback fails to release its allocated resources. No authentication is required to trigger the callback path. Technical details are documented in the VulDB CVE-2026-90712 entry and the OpenClaude GitHub issue #2101.

No verified proof-of-concept code is available for reproduction. Refer to the OpenClaude repository and the linked issue report for source-level context on the vulnerable handler.

Detection Methods for CVE-2026-90712

Indicators of Compromise

Repeated failed OAuth callback requests to the xAI callback endpoint carrying anomalous Error parameter values.
Unexpected termination or restart events for the openclaude process tied to OAuth callback processing.
Spikes in 5xx responses or hanging requests originating from src/services/api/xaiOAuthCallback.ts.

Detection Strategies

Inspect HTTP access logs for requests to the xAI OAuth callback path containing unusual or oversized Error query parameters.
Correlate application-level errors from waitForCallback with subsequent authentication failures for the same client sessions.
Baseline normal OAuth callback traffic patterns and alert on sudden deviations in error rates or request timing.

Monitoring Recommendations

Enable verbose logging on the OAuth callback handler and forward logs to a centralized analytics platform.
Track process health metrics (CPU, memory, event-loop lag) for the openclaude service to catch resource exhaustion early.
Monitor upstream advisories on the OpenClaude GitHub repository for patch availability.

How to Mitigate CVE-2026-90712

Immediate Actions Required

Restrict network exposure of openclaude instances so the xAI OAuth callback endpoint is not reachable from untrusted networks.
Place a reverse proxy or web application firewall in front of the callback endpoint and validate the Error parameter length and character set.
Rate-limit requests to the OAuth callback path to reduce the impact of repeated abuse attempts.

Patch Information

No vendor patch is available at the time of publication. The project was notified through GitHub issue #2101 but has not responded. Track the OpenClaude repository and the VulDB entry for updates. Downgrading is not applicable; all versions up to 0.30.0 are affected.

Workarounds

Disable the xAI OAuth integration in openclaude deployments where it is not required.
Implement upstream input validation to reject malformed or unexpected Error parameter values before they reach waitForCallback.
Educate users to avoid clicking untrusted OAuth callback links, since exploitation requires user interaction.

bash

# Example reverse-proxy filtering for the xAI OAuth callback path (nginx)
location /xai/oauth/callback {
    if ($arg_error ~* "[^A-Za-z0-9_\-]{1,64}") { return 400; }
    limit_req zone=oauth_cb burst=5 nodelay;
    proxy_pass http://openclaude_upstream;
}