Executive brief
Obot is an open-source platform for managing API integrations and workflows. An attacker could trick a logged-in user into clicking a malicious link to steal their API access token, allowing the attacker to read or modify the victim's resources until the token is revoked. No special privileges or technical sophistication are required—the attack succeeds if a victim simply clicks a link.
Technical details
The vulnerability stems from three combined flaws in OAuth dynamic client registration: (1) unauthenticated attackers could register OAuth clients with arbitrary redirect URIs, (2) the authorization flow auto-completed without a consent screen for logged-in users, and (3) issued tokens contained the victim's full group set in the JWT but lacked proper audience validation, allowing tokens scoped for one MCP server to be accepted across the victim's broader API access. An attacker crafts an authorization URL, tricks a logged-in victim into visiting it, and receives an authorization code redirected to the attacker's domain, which is exchanged for an access token. The fix in v0.23.0+ adds a consent screen, restricts MCP token scope to the specific server, and enforces JWT audience validation.
Affected products
- Obot Obot <= v0.22.1
Timeline
- 2026-09-18: disclosed: Security advisory published
- 2026-09-18: patched: Fix released in v0.23.0