1Mcp Agent
Monthly
OAuth tag-scope enforcement bypass in 1MCP Agent 0.20.0 through 0.39.0 lets an authenticated client holding a valid single-tag OAuth token list and invoke tools on backend MCP servers outside its granted scopes by supplying a negated advanced tag-filter expression such as 'not <granted-tag>'. The flaw is rated medium severity (vendor CVSS 4.0 base 5.3, assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) and requires both a valid token (PR:L) and a multi-scope or multi-tenant gateway configuration using OAuth tag-scope enforcement with negation-capable filters, limiting overall impact to low confidentiality and integrity effects. There is no public exploit identified at time of analysis and no CISA KEV confirmation; exploitation depends on the attacker already holding a scoped OAuth token.
OAuth tag-scope enforcement bypass in 1MCP Agent 0.20.0 through 0.39.0 lets an authenticated client holding a valid single-tag OAuth token list and invoke tools on backend MCP servers outside its granted scopes by supplying a negated advanced tag-filter expression such as 'not <granted-tag>'. The flaw is rated medium severity (vendor CVSS 4.0 base 5.3, assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) and requires both a valid token (PR:L) and a multi-scope or multi-tenant gateway configuration using OAuth tag-scope enforcement with negation-capable filters, limiting overall impact to low confidentiality and integrity effects. There is no public exploit identified at time of analysis and no CISA KEV confirmation; exploitation depends on the attacker already holding a scoped OAuth token.