CVE-2026-79786

HighCVSS 7.1/10Last modified Sep 23, 2026

Description

Coroot's unauthenticated MCP OAuth dynamic client registration endpoint accepts any syntactically valid redirect URI without validation, allowing attackers to register clients pointing to attacker-controlled hosts. Attackers can send authorization URLs to signed-in users, capture their authorization codes upon consent approval, and exchange them for access tokens to hijack MCP sessions.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-601

Affected software

Vendor	Product	Versions
coroot	coroot	>= 1.20.2, <= 1.24.5

References

Timeline

Published: Aug 25, 2026
Last modified: Sep 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-797879.8Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allowing unauthenticated attackers CVE-2026-797887.1In Dradis Community Edition, the ProvidersController and AgentsController gate their admin_required before_action on `defined?(Dradis::Pro)`CVE-2026-79794.3Inappropriate implementation in Media in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to leak cross-origin data via a craf CVE-2026-797925.6A flaw has been found in zackees transcribe-anything up to 4.1.0. Affected is the function ytdlp_download of the file src/transcribe_anythin CVE-2026-797934.3A vulnerability has been found in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown functionality of th CVE-2026-797949.1A SQL injection vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker CVE-2026-797969.8Vulnerabilities have been identified in the affected interface of ClearPass Policy Manager that could potentially allow an unauthenticated r CVE-2026-797978.8An improper access control vulnerability exists in the Android client application for HPE Networking ClearPass Policy Manager, where applica CVE-2026-797989.9SQL injection vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow a low-privileged authenticated r CVE-2026-797998.8A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct CVE-2026-79808.8Use after free in WebAudio in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via CVE-2026-798008.8An authenticated path traversal vulnerability exists in the command line interface of ClearPass Policy Manager. Successful exploitation coul