GHSA-C73C-X77G-854R

Vulnerability from github – Published: 2026-05-12 15:34 – Updated: 2026-05-12 15:34
VLAI
Summary
OpenClaude MCP OAuth Callback: State Check Bypass via error Param Leads to DoS
Details

OAuth State Validation Bypass via error Parameter Causes Local Server DoS in MCP Auth Callback

Description

The OpenClaude MCP authentication flow starts a temporary local HTTP server to handle OAuth callbacks. To prevent CSRF attacks, the server validates a state parameter against an internally stored value. However, due to a logic flaw in the order of conditionals, an attacker can completely bypass this check and force the server to shut down — without knowing the state value at all.

The vulnerable code looks like this:

if (!error && state !== oauthState) {
    rejectOnce(new Error('OAuth state mismatch - possible CSRF attack'))
    return
}

if (error) {
    cleanup()
    rejectOnce(new Error(errorMessage))
    return
}

When a request arrives with an error query parameter (e.g., ?error=anything), the first condition becomes false because !error evaluates to false. This means the CSRF check is never reached. Execution falls through to the second block, where cleanup() is called — shutting down the local server and terminating the user's active authentication session.

The attacker does not need to know the state value. Any request containing an error parameter is enough to trigger the shutdown.

Impact

  • The user's OAuth flow is silently terminated mid-session
  • The local callback server is shut down (Denial of Service)
  • Can be triggered remotely via a malicious web page using a cross-origin request (CSRF)
  • No authentication or prior knowledge of the state value is required

Steps to Reproduce

Save the following as poc.js and run with Node.js:

import { createServer } from 'http';
import { parse } from 'url';

const expectedState = "secure_state_abc123";

const server = createServer((req, res) => {
    const parsedUrl = parse(req.url || '', true);
    const { pathname, query } = parsedUrl;
    const { state, error } = query;

    if (pathname === '/callback') {

        // Vulnerable: error param causes state check to be skipped entirely
        if (!error && state !== expectedState) {
            res.writeHead(400);
            res.end('State mismatch');
            console.log('[-] CSRF attempt blocked.');
            return;
        }

        if (error) {
            res.writeHead(200);
            res.end(`Error: ${error}`);
            console.log(`[!] Server shutting down. Triggered by: ${error}`);
            server.close();
            return;
        }
    }
});

server.listen(12345, '127.0.0.1', () => {
    console.log('Listening on http://127.0.0.1:12345');
});

Terminal 1 — start the server:

node poc.js

Terminal 2 — trigger the bypass:

curl "http://127.0.0.1:12345/callback?error=triggered"

Expected result: Server shuts down immediately. The state value was never checked.

Root Cause

The CSRF protection is conditioned on !error, meaning it is silently disabled whenever an error parameter is present. The two checks need to be decoupled — state validation must happen first, independently of any other parameters.

Fix

Move the state check before the error check, and remove the dependency on !error:

// Fixed
if (state !== oauthState) {
    cleanup()
    rejectOnce(new Error('OAuth state mismatch - possible CSRF attack'))
    return
}

if (error) {
    cleanup()
    rejectOnce(new Error(errorMessage))
    return
}

With this change, any request — whether it contains an error parameter or not — must first pass the state validation before any further processing occurs.

Credit: Xanlar Agamalizade

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@gitlawb/openclaude"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.5.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-42073"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352",
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-12T15:34:30Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "# OAuth State Validation Bypass via `error` Parameter Causes Local Server DoS in MCP Auth Callback\n---\n\n## Description\n\nThe OpenClaude MCP authentication flow starts a temporary local HTTP server to handle OAuth callbacks. To prevent CSRF attacks, the server validates a `state` parameter against an internally stored value. However, due to a logic flaw in the order of conditionals, an attacker can completely bypass this check and force the server to shut down \u2014 without knowing the `state` value at all.\n\nThe vulnerable code looks like this:\n\n```typescript\nif (!error \u0026\u0026 state !== oauthState) {\n    rejectOnce(new Error(\u0027OAuth state mismatch - possible CSRF attack\u0027))\n    return\n}\n\nif (error) {\n    cleanup()\n    rejectOnce(new Error(errorMessage))\n    return\n}\n```\n\nWhen a request arrives with an `error` query parameter (e.g., `?error=anything`), the first condition becomes `false` because `!error` evaluates to `false`. This means the CSRF check is **never reached**. Execution falls through to the second block, where `cleanup()` is called \u2014 shutting down the local server and terminating the user\u0027s active authentication session.\n\nThe attacker does not need to know the `state` value. Any request containing an `error` parameter is enough to trigger the shutdown.\n\n---\n\n## Impact\n\n- The user\u0027s OAuth flow is silently terminated mid-session\n- The local callback server is shut down (Denial of Service)\n- Can be triggered remotely via a malicious web page using a cross-origin request (CSRF)\n- No authentication or prior knowledge of the `state` value is required\n\n---\n\n## Steps to Reproduce\n\nSave the following as `poc.js` and run with Node.js:\n\n```javascript\nimport { createServer } from \u0027http\u0027;\nimport { parse } from \u0027url\u0027;\n\nconst expectedState = \"secure_state_abc123\";\n\nconst server = createServer((req, res) =\u003e {\n    const parsedUrl = parse(req.url || \u0027\u0027, true);\n    const { pathname, query } = parsedUrl;\n    const { state, error } = query;\n\n    if (pathname === \u0027/callback\u0027) {\n\n        // Vulnerable: error param causes state check to be skipped entirely\n        if (!error \u0026\u0026 state !== expectedState) {\n            res.writeHead(400);\n            res.end(\u0027State mismatch\u0027);\n            console.log(\u0027[-] CSRF attempt blocked.\u0027);\n            return;\n        }\n\n        if (error) {\n            res.writeHead(200);\n            res.end(`Error: ${error}`);\n            console.log(`[!] Server shutting down. Triggered by: ${error}`);\n            server.close();\n            return;\n        }\n    }\n});\n\nserver.listen(12345, \u0027127.0.0.1\u0027, () =\u003e {\n    console.log(\u0027Listening on http://127.0.0.1:12345\u0027);\n});\n```\n\n**Terminal 1 \u2014 start the server:**\n```bash\nnode poc.js\n```\n\n**Terminal 2 \u2014 trigger the bypass:**\n```bash\ncurl \"http://127.0.0.1:12345/callback?error=triggered\"\n```\n\n**Expected result:** Server shuts down immediately. The `state` value was never checked.\n\n---\n\n## Root Cause\n\nThe CSRF protection is conditioned on `!error`, meaning it is silently disabled whenever an `error` parameter is present. The two checks need to be decoupled \u2014 state validation must happen first, independently of any other parameters.\n\n---\n\n## Fix\n\nMove the `state` check before the `error` check, and remove the dependency on `!error`:\n\n```typescript\n// Fixed\nif (state !== oauthState) {\n    cleanup()\n    rejectOnce(new Error(\u0027OAuth state mismatch - possible CSRF attack\u0027))\n    return\n}\n\nif (error) {\n    cleanup()\n    rejectOnce(new Error(errorMessage))\n    return\n}\n```\n\nWith this change, any request \u2014 whether it contains an `error` parameter or not \u2014 must first pass the state validation before any further processing occurs.\n\n---\n\nCredit: Xanlar Agamalizade",
  "id": "GHSA-c73c-x77g-854r",
  "modified": "2026-05-12T15:34:30Z",
  "published": "2026-05-12T15:34:30Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Gitlawb/openclaude/security/advisories/GHSA-c73c-x77g-854r"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Gitlawb/openclaude/commit/739b8d1f40fde0e401a5cbd2b9a55d88bd5124ad"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Gitlawb/openclaude"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Gitlawb/openclaude/releases/tag/v0.5.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenClaude MCP OAuth Callback: State Check Bypass via error Param Leads to DoS"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.