MCP Atlassian EUVD-2026-84749

Exploitation requires that a deployment uses MCP Atlassian's OAuth authentication setup flow and that a targeted user is actively completing that flow when they open the attacker's crafted authorization callback (the 'error' query parameter carrying the injected markup). Limiting factors: user interaction is mandatory (victim must visit/complete the malicious callback, UI:R), impact is confined to the victim's browser context (C:L/I:L, no server-side code execution or Atlassian data-plane access), and the OAuth setup path must be in use - deployments configured with token/PAT or basic auth rather than the interactive OAuth flow are not exposed. Affects only versions prior to 0.22.0.

This is a genuine but modest-severity issue. The CVSS 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) is internally consistent with a reflected XSS: unauthenticated at the vulnerable endpoint but requiring a victim to complete the OAuth setup flow (UI:R), yielding only partial confidentiality/integrity impact (browser-context script execution, not server compromise). No EPSS score, no CISA KEV listing, and no public exploit code are provided, so exploitation is theoretical at this time. There is no SSVC framing in the input. The practical risk is bounded by the narrow trigger surface: the OAuth setup/authorization callback flow of a niche, self-hosted developer tool that a targeted user must actively be completing at the moment of attack. This is a real-but-low-priority hygiene fix rather than an urgent, mass-exploitable flaw; C:L/I:L means it steals session state or acts in the browser context of one operator, not the Atlassian data plane. Note the provided PR#1448 diff hunks show attachment path-hardening, SSRF redirect/DNS pinning, and CQL spaces-filter fixes - sibling issues in the same batched release - and do NOT show the oauth_setup.py escaping change itself, so the specific fix is confirmed only by the advisory/description, not by the shown source evidence.

An attacker crafts a malicious OAuth authorization callback URL whose 'error' query parameter contains HTML/JavaScript markup, then lures an operator who is completing the MCP Atlassian OAuth setup into visiting it. Because the error value is interpolated into the callback response HTML without escaping, the injected script executes in the operator's browser, enabling session/token theft or UI manipulation in that browser context. No public exploit code is identified at time of analysis, but the injection is trivial to construct given the described sink.