Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 20:41:22 +0000 EUVD-2026-361474 https://cve.radiocsirt.org/vuln/euvd-2026-361474 EUVD-2026-361474 https://cve.radiocsirt.org/vuln/euvd-2026-361474 fkie_cve-2026-79786 https://cve.radiocsirt.org/vuln/fkie_cve-2026-79786 <p>Coroot&#39;s unauthenticated MCP OAuth dynamic client registration endpoint accepts any syntactically valid redirect URI without validation, allowing attackers to register clients pointing to attacker-controlled hosts. Attackers can send authorization URLs to signed-in users, capture their authorization codes upon consent approval, and exchange them for access tokens to hijack MCP sessions.</p> <p>Coroot&#39;s unauthenticated MCP OAuth dynamic client registration endpoint accepts any syntactically valid redirect URI without validation, allowing attackers to register clients pointing to attacker-controlled hosts. Attackers can send authorization URLs to signed-in users, capture their authorization codes upon consent approval, and exchange them for access tokens to hijack MCP sessions.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-79786 GHSA-g3gf-mwj7-2hc4 https://cve.radiocsirt.org/vuln/ghsa-g3gf-mwj7-2hc4 <p>Coroot&#39;s unauthenticated MCP OAuth dynamic client registration endpoint accepts any syntactically valid redirect URI without validation, allowing attackers to register clients pointing to attacker-controlled hosts. Attackers can send authorization URLs to signed-in users, capture their authorization codes upon consent approval, and exchange them for access tokens to hijack MCP sessions.</p> <p>Coroot&#39;s unauthenticated MCP OAuth dynamic client registration endpoint accepts any syntactically valid redirect URI without validation, allowing attackers to register clients pointing to attacker-controlled hosts. Attackers can send authorization URLs to signed-in users, capture their authorization codes upon consent approval, and exchange them for access tokens to hijack MCP sessions.</p> https://cve.radiocsirt.org/vuln/ghsa-g3gf-mwj7-2hc4