CVE-2026-32112

MediumCVSS 4.7/10Last modified Jun 17, 2026

Description

ha-mcp is a Home Assistant MCP Server. Prior to 7.0.0, the ha-mcp OAuth consent form renders user-controlled parameters via Python f-strings with no HTML escaping. An attacker who can reach the OAuth endpoint and convince the server operator to follow a crafted authorization URL could execute JavaScript in the operator's browser. This affects only users running the beta OAuth mode (ha-mcp-oauth), which is not part of the standard setup and requires explicit configuration. This vulnerability is fixed in 7.0.0.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Mar 11, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-321136.1Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2CVE-2026-321144.3Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, there is an Insecure Direct ObCVE-2026-321168.1Magic Wormhole makes it possible to get arbitrary-sized files and directories from one computer to another. From 0.21.0 to before 0.23.0, reCVE-2026-321175.4The grafanacubism-panel plugin allows use of cubism.js in Grafana. In 0.1.2 and earlier, the panel's zoom-link handler passes a dashboard-edCVE-2026-321189.0OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, stored cross-siteCVE-2026-321194.4OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, DOM-based stored CVE-2026-32125.4Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Tagify allows Cross-Site ScriptCVE-2026-321206.3OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, an InsecuCVE-2026-321215.4OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, Stored XSS in prCVE-2026-321224.3OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, the Claim File TrCVE-2026-321236.5OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, sensitivity checkCVE-2026-321245.4OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, the dynamic code