PT-2026-122082

CVE-2026-115750

·

Published

2026-10-23

·

Updated

2026-10-23

Description by

CVSS 3.1
3.7
Low
MetricsAV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
mcp-from-openapi from 2.5.0 before 2.9.0 contains a credential exposure vulnerability that allows attackers to capture Authorization and Cookie headers because safeFetch() forwards them on cross-origin redirects. Attackers controlling a spec host or abusing an open redirect can redirect fromURL() spec requests to their own origin to steal bearer tokens or cookies.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-522: Insufficiently Protected Credentials
Related identifiers
CVE-2026-115750
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com