Is CVE-2026-90712 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-90712 being exploited in the wild.

How severe is CVE-2026-90712?

Medium severity, with a CVSS score of 4.3, published 14 September 2026.

Which products and versions are affected?

Gitlawb openclaude up to 0.30.0.

Is there a fix for CVE-2026-90712?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-90712 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-90712?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-90712: Gitlawb openclaude xAI OAuth state validation bypass

CVE-2026-90712 · Severity: medium · CVSS 4.3 · Published 2026-09-14

OpenClaude is an open-source terminal application that integrates with various AI services including xAI for authentication. A vulnerability in the xAI OAuth callback handler allows an attacker to disrupt user login flows by sending a malicious request from an external website, causing the legitimate authentication to fail without the user's knowledge. This can prevent users from logging into the application when attempting to use xAI-based features.

Quick answers

Is CVE-2026-90712 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-90712 being exploited in the wild.
How severe is CVE-2026-90712?: Medium severity, with a CVSS score of 4.3, published 14 September 2026.
Which products and versions are affected?: Gitlawb openclaude up to 0.30.0.
Is there a fix for CVE-2026-90712?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-90712 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-90712?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a state validation bypass in the xAI OAuth loopback callback handler (src/services/api/xaiOAuthCallback.ts). The function waitForCallback() processes the error query parameter before validating the CSRF state token, allowing an unauthenticated attacker to issue a cross-origin GET request to http://127.0.0.1:56121/callback?error=access_denied and prematurely terminate a legitimate OAuth flow. An attacker can trigger this via an image tag or fetch request on a malicious website visited during the victim's authentication attempt. The server runs on a fixed port (56121), making it consistently reachable. When the error parameter is detected, the handler marks the flow as settled and rejects the promise without verifying the state parameter, causing subsequent legitimate OAuth responses to be ignored. A patch should reorder validation to check the state token before processing error or code parameters, consistent with fixes applied to related MCP OAuth handlers.

Affected products

Gitlawb openclaude up to 0.30.0

Timeline

2026-08-07: disclosed: Issue #2101 opened on GitHub
2026-09-14: advisory: CVE-2026-90712 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.