Executive brief
Coroot is an open-source observability and APM (Application Performance Monitoring) platform that monitors system performance and logs. An attacker can exploit a flaw in Coroot's OAuth setup to register malicious applications with any redirect URL and intercept user sessions. By tricking authenticated users into clicking a link, attackers can capture their authorization tokens and gain unauthorized access to Coroot systems.
Technical details
The vulnerability is an OAuth redirect URI validation bypass in Coroot's MCP (Model Context Protocol) OAuth dynamic client registration endpoint. The endpoint accepts any syntactically valid redirect URI without verifying that it belongs to a legitimate application, and requires no authentication to register a client. An attacker can register a malicious OAuth client pointing to an attacker-controlled host, craft an authorization URL, and send it to legitimate Coroot users. When users approve the authorization request, their browser is redirected to the attacker's server with the authorization code, which the attacker can exchange for access tokens to hijack MCP sessions. Patches should implement strict redirect URI validation and authentication requirements on the registration endpoint.
Affected products
- Coroot Coroot v1.24.5 and likely earlier
Timeline
- 2026-08-25: disclosed