Theodoros Lampropoulos

An issue exists where unauthenticated attackers can control the hosts of emailed links. This is achieved by supplying `x-authorizer-url` gRPC metadata to the gRPC port or using a `Grpc-Metadata-X-Authorizer-Url` header via the REST gateway. This allows attackers to capture reset or magic-link tokens, potentially leading to account takeover.

An improper validation issue exists in the MCP OAuth login flow. The system uses server-supplied Protected Resource Metadata as the resource indicator without verifying that it matches the configured server URL. This allows a malicious MCP server to declare a different resource on the same authorization server, obtain the user's bearer token for that resource, and subsequently replay the token against it.

Improper validation in the `fetchServerMetadata()` function of the `OAuthHandler` allows malicious MCP servers to obtain tokens for unauthorized resources. By declaring arbitrary resources in well-known metadata, an attacker can specify a different MCP server as the RFC 8707 resource indicator, leading the authorization server to issue tokens that the attacker can then replay against that resource.