Executive brief
utcp-http is a Python library for automatically generating client tools from remote OpenAPI specifications. The library failed to validate the OAuth2 token endpoint URL embedded in OpenAPI specs, allowing an attacker who controls an OpenAPI spec to direct victim credentials to an attacker-controlled server or internal network endpoint. When a victim registers a malicious spec and calls any OAuth2-protected tool, the library automatically posts the victim's OAuth2 client credentials to the attacker's token endpoint without validation.
Technical details
The vulnerability is a trust boundary bypass in the OpenAPI-to-tool conversion pipeline. The vulnerable component is `OpenApiConverter._extract_auth()` in openapi_converter.py (line 369), which reads the OAuth2 `tokenUrl` field directly from a remote OpenAPI specification without any validation. The `tokenUrl` is then stored verbatim in an `OAuth2Auth` object and later used in `HttpCommunicationProtocol._handle_oauth2()` (line 376) to POST client credentials via `session.post(auth_details.token_url, data=body_data)`. The root cause is the absence of the `ensure_secure_url()` validation check that is correctly applied to discovery URLs (line 129) and tool invocation URLs (line 281) but missing for the OAuth2 token endpoint. An attacker can craft a malicious OpenAPI spec with a `tokenUrl` pointing to an attacker-controlled HTTPS endpoint or internal HTTP address; no authentication is required to serve the spec, and the victim needs only to register it and invoke any OAuth2-protected tool. The attack results in exfiltration of `client_id` and `client_secret` credentials, and enables Server-Side Request Forgery (SSRF) to internal endpoints. The vulnerability was patched in utcp-http 1.1.4 by adding `ensure_secure_url()` validation at both conversion time and runtime, and by using redirect-safe request methods.
Affected products
- universal-tool-calling-protocol utcp-http <= 1.1.3
Timeline
- 2026-06-14: disclosed: GitHub Advisory GHSA-8cp3-qxj6-px34 published
- 2026-08-25: patched: Fixed in utcp-http 1.1.4 (and utcp-gql 1.1.1, utcp-websocket 1.1.1, @utcp/http 1.1.4)