OAuth2 TokenURL Trust Boundary Bypass in utcp-http by Universal Tool Calling Protocol

CVE-2026-101059

What is CVE-2026-101059?

The vulnerability in utcp-http versions prior to 1.1.4 arises from the failure to properly validate the tokenUrl field in OAuth2 configurations derived from remote OpenAPI specifications. This oversight allows attackers to redirect sensitive credential submissions to unauthorized endpoints. By leveraging this flaw, an attacker can create a malicious OpenAPI specification and, when a victim uses an OAuth2-protected tool generated by the library, the victim's client_id and client_secret may be inadvertently sent to the attacker's designated token endpoint without any URL validation safeguard.

References