Unvalidated Redirect URI Vulnerability in Coroot MCP OAuth Endpoint

CVE-2026-79786

What is CVE-2026-79786?

The Coroot MCP OAuth dynamic client registration endpoint allows unauthenticated requests that accept any syntactically valid redirect URI without proper validation. This oversight permits attackers to register clients that redirect to malicious domains. By exploiting this weakness, attackers can craft authorization URLs and share them with authenticated users. If users consent to authorization, attackers can capture authorization codes and subsequently exchange them for access tokens. This process leads to the potential hijacking of active MCP sessions, compromising user accounts and sensitive information.

References