Coroot
Monthly
Unauthenticated OAuth redirect URI hijacking in Coroot versions 1.20.2 through 1.24.5 allows attackers to register malicious MCP OAuth clients without any credentials, then capture authorization codes from signed-in users who follow crafted authorization URLs and approve a consent dialog. The captured codes can be exchanged for valid access tokens, enabling full MCP session hijacking. No public exploit has been identified at time of analysis and no CISA KEV listing is present, but the registration step requires no authentication, materially lowering attacker prerequisites.
Unauthenticated OAuth redirect URI hijacking in Coroot versions 1.20.2 through 1.24.5 allows attackers to register malicious MCP OAuth clients without any credentials, then capture authorization codes from signed-in users who follow crafted authorization URLs and approve a consent dialog. The captured codes can be exchanged for valid access tokens, enabling full MCP session hijacking. No public exploit has been identified at time of analysis and no CISA KEV listing is present, but the registration step requires no authentication, materially lowering attacker prerequisites.