AmoyLab Unla CVE-2026-108865

Exploitation requires that the target run AmoyLab Unla at or below version 0.10.0 with its OAuth2 authorization server exposed and its /authorize and /token endpoints network-reachable; these endpoints protect the MCP prefixes, proxied upstream APIs, and injected credentials that the attacker gains access to. The core defect is that the OAuth2 server never authenticates a resource owner, so no credentials, user interaction, or special non-default configuration are needed beyond having the OAuth2-protected MCP gateway deployed and reachable. The only meaningful limiting factor is exposure of the Unla OAuth2 service to the attacker's network position (e.g., instances not reachable from the attacker are not exploitable); there is no authentication or user-interaction barrier once the service is reachable.

This is a genuine high-priority issue for anyone running AmoyLab Unla, not a high-CVSS-but-low-risk paper finding. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity attack requiring no privileges and no user interaction, which is fully consistent with the description: the OAuth2 server never authenticates a resource owner, so any unauthenticated attacker can mint valid access tokens via the standard register→/authorize→/token flow. The signals align rather than conflict - the mechanism is a complete authentication bypass (CWE-287), and VC:H reflects access to OAuth2-protected MCP prefixes, proxied upstream APIs, and injected credentials. Tempering the raw severity: no EPSS score is provided, there is no CISA KEV listing, and no public exploit code is referenced, so there is no evidence of active or widespread exploitation yet. The reporting by VulnCheck plus a detailed public technical write-up (hackmd) with exact source-line references means weaponization would be trivial even though no packaged PoC is cited. Real-world risk is therefore driven more by product prevalence than by exploitation telemetry: the flaw is trivially exploitable wherever Unla's OAuth2 is exposed, but Unla is a niche MCP gateway, so the practical attack surface is limited to that comparatively small deployed base.

An unauthenticated attacker reachable over the network registers an OAuth2 client against an exposed Unla instance, calls /authorize to obtain an authorization code without any resource-owner login, and exchanges it at /token for a valid access token. With that token the attacker reaches OAuth2-protected MCP prefixes, drives proxied upstream APIs, and retrieves injected credentials. No packaged public exploit is referenced, but a detailed technical write-up with exact source-line references makes reproduction straightforward given the low attack complexity and lack of required privileges.