CVE-2026-90712

Name of the Vulnerable Software and Affected Versions Gitlawb openclaude versions prior to 0.31.0

Description A denial of service can be triggered remotely via the xAI OAuth Callback Handler component. The issue exists in the waitForCallback() function within the src/services/api/xaiOAuthCallback.ts file, where manipulation of the Error argument allows for the attack.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting the use of the waitForCallback() function.