Authentication Bypass in Obot Products by Vendor Obot

CVE-2026-101062

What is CVE-2026-101062?

Obot versions prior to 0.23.0 exhibit a serious security flaw that permits OAuth dynamic client registration without any necessary authentication. By enabling the setting OBOT_SERVER_ENABLE_AUTHENTICATION to true, it exposes multiple risks to users. Attackers are capable of creating malicious authorization URLs that, if accessed by a logged-in user, result in the automatic issuance of an authorization code at an attacker-controlled redirect URI. Due to the absence of proper audience validation and restrictions on the redirect URIs for registered clients, these tokens can allow the attacker to access and manipulate the victim’s resources across any Obot API endpoint accessible by the victim. The introduction of version 0.23.0 addresses these issues by adding a consent screen, limiting the scope of the OAuth tokens to the relevant MCP, and enforcing audience validation, thereby mitigating the risks associated with this vulnerability.

References