Read the docs
TI-2026-65095 Aliases CVE-2026-101062GHSA-cfp9-746c-5jrw

Obot before v0.23.0 Authentication Bypass via OAuth Dynamic Client Registration

Priority MEDIUM 40CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

Obot before v0.23.0 (affected versions <= v0.22.1) running with OBOT_SERVER_ENABLE_AUTHENTICATION=true exposes OAuth dynamic client registration without authentication and without any restriction on the redirect URIs a client may register. Because the authorization flow auto-completes for an already logged-in user with no consent screen, an attacker who registers a client pointing at their own domain and induces a logged-in victim to visit a single crafted authorization URL receives an authorization code at the attacker-controlled redirect URI and can exchange it for an access token and refresh token. The token minted by the MCP OAuth flow carries the victim's full group set in the JWT, and Obot validated only the issuer and not the audience, so the token is accepted as a bearer token against any Obot API endpoint the victim can access rather than being scoped to the requested MCP server, allowing the attacker to read or modify the victim's resources until the token is revoked. v0.23.0 adds a consent screen, restricts MCP OAuth tokens to the MCP involved in the request, and enforces audience validation.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00336 27th percentileScored 2026-11-07
Fix Fixed obot (obot-platform): 0.23.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
obot-platformobotbefore 0.23.00.23.0Patch availableCNA
  • obot Vendorobot-platform Affected before 0.23.0 Fixed in 0.23.0 Patch available CNA

Remediation

  • Fix · CNA obot (obot-platform) Fixed in 0.23.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    obot-platform obot 0.23.0

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-65097 Obot before v0.23.0 Server-Side Request Forgery via MCPPriority LOW 36
    • TI-2026-65096 Obot before v0.23.0 Authentication Bypass via Registry APIPriority LOW 36
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-101062
  2. 2026-10-03 Alias added: GHSA-cfp9-746c-5jrw

References

Advisory 1

  • TI-2026-65117 obot before v0.21.1 Authorization Bypass via /mcp-connect CVSS 4.0CRITICAL 9.3
  • TI-2026-65098 Obot Quickstart Docker Deployment Unauthenticated Admin Access CVSS 4.0CRITICAL 9.3
  • TI-2026-65757 Obot 0.21.1 through 0.24.1 Authorization Bypass via /mcp-connect-composite/ Route CVSS 4.0HIGH 8.6
  • TI-2026-79161 Authentication bypass in Obot CLI login exposes API keys CVSS 4.0HIGH 8.6
  • TI-2026-65097 Obot before v0.23.0 Server-Side Request Forgery via MCP CVSS 4.0HIGH 8.3
  • TI-2026-65096 Obot before v0.23.0 Authentication Bypass via Registry API CVSS 4.0MEDIUM 6.9
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences