{"vulnerability": "GHSA-XWMW-PRC4-V3CR", "sightings": [{"uuid": "b4124ade-e9a9-4ebe-8d9b-e37009397eeb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-XWMW-PRC4-V3CR", "type": "seen", "source": "https://gist.github.com/alon710/da0a2d4f39c3478c9853ea6e81af7824", "content": "# GHSA-XWMW-PRC4-V3CR: GHSA-XWMW-PRC4-V3CR: OAuth Dynamic Client Registration Enables API Token Theft via Audience Confusion in Obot Platform\n\n> **CVSS Score:** 8.8\n> **Published:** 2026-09-18\n> **Full Report:** https://cvereports.com/reports/GHSA-XWMW-PRC4-V3CR\n\n## Summary\nA critical security vulnerability exists in the Obot Platform (versions < 0.23.0) where unauthenticated OAuth dynamic client registration, a consentless authorization flow, and a lack of JWT audience validation enable remote attackers to steal API tokens via audience confusion.\n\n## TL;DR\nUnauthenticated OAuth client registration and missing audience validation allow attackers to harvest administrative JWTs via a silent, zero-interaction authorization flow redirection.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-863\n- **Attack Vector**: Network\n- **CVSS Score**: 8.8\n- **EPSS Score**: N/A (No CVE Assigned)\n- **Impact**: Remote Code Execution / Privilege Escalation\n- **Exploit Status**: PoC Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Obot Platform (github.com/obot-platform/obot) running with OBOT_SERVER_ENABLE_AUTHENTICATION=true\n- **obot**: < 0.23.0 (Fixed in: `v0.23.0`)\n\n## Mitigation\n\n- Disable public access to OAuth registration endpoints\n- Enforce network zoning to isolate the Obot server\n- Implement administrative review of registered clients\n\n**Remediation Steps:**\n1. Upgrade Obot to v0.23.0 or later immediately.\n2. If upgrade is not possible, implement WAF rules to block POST requests to /oauth/register.\n3. Review logs for unrecognized OAuth clients.\n\n## References\n\n- [Official GitHub Security Advisory](https://github.com/obot-platform/obot/security/advisories/GHSA-xwmw-prc4-v3cr)\n- [GitHub Advisory Database Entry](https://github.com/advisories/GHSA-xwmw-prc4-v3cr)\n- [Official Patched Release (v0.23.0)](https://github.com/obot-platform/obot/releases/tag/v0.23.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-XWMW-PRC4-V3CR) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-19T00:32:16.271662Z"}]}