Ori-Ron

The '/mcp-oauth/register' endpoint allows OAuth client registrations without authentication, which permits the registration of arbitrary `redirect uri` values. When a user denies the MCP OAuth consent dialog, the `handleDeny()` handler redirects the user to the registered `redirect uri` without validation. This creates an open redirect, allowing an attacker to use a phishing link to silently redirect a victim to an external, attacker-controlled site if the victim clicks "Deny" on the consent page.

The MCP OAuth client registration endpoint accepts unauthenticated requests and stores client data without adequate resource controls. A remote attacker can exhaust server memory resources by sending large registration payloads, leading to a denial of service that renders the instance unavailable. The endpoint remains reachable even if the MCP enable/disable toggle is used to gate access.

n8n is a workflow automation platform susceptible to arbitrary script injection. An authenticated user with permission to create or modify workflows could inject malicious scripts into pages rendered by the n8n application through various nodes, including the Form Trigger node, Chat Trigger node, Send & Wait node, Webhook Node, and Chat Node. These injected scripts execute in the browser of any user visiting the affected page, potentially leading to session hijacking and account takeover.

FreeRDP is a free implementation of the Remote Desktop Protocol. A previous fix for a heap-use-after-free issue was incomplete. The vulnerable code exists in the SDL2 implementation, where a pointer is not nulled after being freed, potentially leading to a security issue. The fix was initially applied only to the SDL3 code path.