CVE-2026-42073

OAuth State Validation Bypass via error Parameter Causes Local Server DoS in MCP Auth Callback

Description

The OpenClaude MCP authentication flow starts a temporary local HTTP server to handle OAuth callbacks. To prevent CSRF attacks, the server validates a state parameter against an internally stored value. However, due to a logic flaw in the order of conditionals, an attacker can completely bypass this check and force the server to shut down, without knowing the state value at all.

The vulnerable code looks like this:

if (!error && state !== oauthState) {
    rejectOnce(new Error('OAuth state mismatch - possible CSRF attack'))
    return
}

if (error) {
    cleanup()
    rejectOnce(new Error(errorMessage))
    return
}

When a request arrives with an error query parameter (e.g., ?error=anything), the first condition becomes false because !error evaluates to false. This means the CSRF check is never reached. Execution falls through to the second block, where cleanup() is called, shutting down the local server and terminating the user's active authentication session.

The attacker does not need to know the state value. Any request containing an error parameter is enough to trigger the shutdown.

Steps to Reproduce

Save the following as poc.js and run with Node.js:

import { createServer } from 'http';
import { parse } from 'url';

const expectedState = "secure_state_abc123";

const server = createServer((req, res) => {
    const parsedUrl = parse(req.url || '', true);
    const { pathname, query } = parsedUrl;
    const { state, error } = query;

    if (pathname === '/callback') {

        // Vulnerable: error param causes state check to be skipped entirely
        if (!error && state !== expectedState) {
            res.writeHead(400);
            res.end('State mismatch');
            console.log('[-] CSRF attempt blocked.');
            return;
        }

        if (error) {
            res.writeHead(200);
            res.end(`Error: ${error}`);
            console.log(`[!] Server shutting down. Triggered by: ${error}`);
            server.close();
            return;
        }
    }
});

server.listen(12345, '127.0.0.1', () => {
    console.log('Listening on http://127.0.0.1:12345');
});

Terminal 1, start the server:

node poc.js

Terminal 2, trigger the bypass:

curl "http://127.0.0.1:12345/callback?error=triggered"

Expected result: Server shuts down immediately. The state value was never checked.

Root Cause

The CSRF protection is conditioned on !error, meaning it is silently disabled whenever an error parameter is present. The two checks need to be decoupled, state validation must happen first, independently of any other parameters.

Credit: Xanlar Agamalizade

• The user's OAuth flow is silently terminated mid-session
• The local callback server is shut down (Denial of Service)
• Can be triggered remotely via a malicious web page using a cross-origin request (CSRF)
• No authentication or prior knowledge of the state value is required

A victim's authenticated browser session is used to submit forged requests to an application that cannot distinguish them from legitimate ones. Typical impact: state-changing actions performed as the victim without their consent.

CVE-2026-42073 has a CVSS score of 6.5 (Medium). The vector is network-reachable, no privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (0.5.1); upgrading removes the vulnerable code path.

Kodem intelligence

Move the state check before the error check, and remove the dependency on !error:

// Fixed
if (state !== oauthState) {
    cleanup()
    rejectOnce(new Error('OAuth state mismatch - possible CSRF attack'))
    return
}

if (error) {
    cleanup()
    rejectOnce(new Error(errorMessage))
    return
}

With this change, any request, whether it contains an error parameter or not, must first pass the state validation before any further processing occurs.

1. What is CVE-2026-42073? CVE-2026-42073 is a medium-severity cross-site request forgery (CSRF) vulnerability in @gitlawb/openclaude (npm), affecting versions < 0.5.1. It is fixed in 0.5.1. A victim's authenticated browser session is used to submit forged requests to an application that cannot distinguish them from legitimate ones.
2. How severe is CVE-2026-42073? CVE-2026-42073 has a CVSS score of 6.5 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of @gitlawb/openclaude are affected by CVE-2026-42073? @gitlawb/openclaude (npm) versions < 0.5.1 is affected.
4. Is there a fix for CVE-2026-42073? Yes. CVE-2026-42073 is fixed in 0.5.1. Upgrade to this version or later.
5. Is CVE-2026-42073 exploitable, and should I be worried? Whether CVE-2026-42073 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-42073 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-42073? Upgrade @gitlawb/openclaude to 0.5.1 or later.