Most recent entries from all

EUVD-2026-275723

2026-10-18T07:38:42.065483+00:00

EUVD-2026-275723

fkie_cve-2026-32112

2026-10-18T07:38:42.065514+00:00

ha-mcp is a Home Assistant MCP Server. Prior to 7.0.0, the ha-mcp OAuth consent form renders user-controlled parameters via Python f-strings with no HTML escaping. An attacker who can reach the OAuth endpoint and convince the server operator to follow a crafted authorization URL could execute JavaScript in the operator's browser. This affects only users running the beta OAuth mode (ha-mcp-oauth), which is not part of the standard setup and requires explicit configuration. This vulnerability is fixed in 7.0.0.

GHSA-pf93-j98v-25pv — ha-mcp has XSS via Unescaped HTML in OAuth Consent Form

2026-10-18T07:38:42.065546+00:00

Affected: PyPI: ha-mcp

### Summary

The ha-mcp OAuth consent form renders user-controlled parameters via Python f-strings with no HTML escaping. An attacker who can reach the OAuth endpoint and convince the server operator to follow a crafted authorization URL could execute JavaScript in the operator's browser. This affects only users running the beta OAuth mode (`ha-mcp-oauth`), which is not part of the standard setup and requires explicit configuration.

### Details

**Unescaped f-string rendering**

`consent_form.py` builds HTML using Python f-strings. No call to `html.escape()` exists anywhere in the file. The following values are rendered unescaped:

- `client_name` / `client_id` — in HTML element context (lines 299, 303) - `client_id`, `redirect_uri`, `state` — in HTML attribute context (lines 310–312), where a `"` character breaks out of `value=""` - `error_message`, `error`, `error_description` — in error display paths (lines 36–40, 496–497)

An attacker can register a client with a malicious `client_name` via the `/register` (DCR) endpoint, which accepts `client_name` without sanitization. If the server operator then visits a crafted authorization URL for that client, the payload executes in their browser.

**Open Dynamic Client Registration**

DCR is enabled by default with no initial access token required. This is intentional: Claude.ai and ChatGPT must self-register on first use, which is the standard MCP OAuth flow (RFC 7591). Requiring a pre-shared token would break those integration…