CVE-2026-79786

Name of the Vulnerable Software and Affected Versions Coroot (affected versions not specified)

Description An unauthenticated MCP OAuth dynamic client registration endpoint accepts any syntactically valid redirect URI without validation. This allows attackers to register clients that point to hosts under their control. By sending authorization URLs to signed-in users, attackers can capture authorization codes after consent is granted and exchange them for access tokens to hijack MCP sessions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.