Executive brief
Atlassian's MCP (Model Context Protocol) tool includes an OAuth 2.0 setup wizard with a local callback server that fails to sanitize user input. An attacker can craft a malicious link containing JavaScript code that executes in a victim's browser when they are running the setup wizard, potentially allowing theft of session cookies or OAuth tokens. The callback server listens on all network interfaces, making it accessible to anyone on the victim's network during the 5-minute setup window.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in the OAuth callback handler in `src/mcp_atlassian/utils/oauth_setup.py`. The vulnerability occurs because the `error` query parameter is read from the request and injected directly into an HTML response via f-string interpolation without HTML entity encoding. The callback HTTP server binds to all network interfaces (0.0.0.0) rather than localhost, expanding the attack surface to any machine on the local network. An attacker can deliver a crafted callback URL containing JavaScript (e.g., `http://victim-ip:8080/callback?error=<script>alert('xss')</script>`) which executes when the victim clicks the link. The server runs for up to 300 seconds during the OAuth setup flow, providing a meaningful exploitation window. The response also lacks security headers (CSP, X-Content-Type-Options, X-XSS-Protection) that might mitigate the attack.
Affected products
- Atlassian MCP <UNKNOWN>
Timeline
- 2026-09-22: disclosed
- other: CVE-2026-77272 assigned