Summary
Obot: OAuth Dynamic Client Registration Enables API Token Theft via Audience Confusion
In affected versions, an unauthenticated attacker could register an OAuth client with an arbitrary external redirect URI, and the authorization flow would auto-complete without a consent screen. If a logged-in victim visited a crafted authorization URL, an authorization code was delivered to the attacker's redirect URI and exchanged for an access token. That token was minted with the victim's full set of groups, so it could be used as a bearer token against the Obot API endpoints the victim had access to, rather than being scoped to just the requested MCP server.
Am I affected?
You are affected if you run Obot <= v0.22.1 with OBOT_SERVER_ENABLE_AUTHENTICATION=true. Exploitation requires a logged-in victim to visit a single attacker-controlled authorization URL.
Details
Three issues combined to create this vulnerability. First, OAuth dynamic client registration was reachable without authentication and applied no restriction on the redirect URIs a client could register, so an attacker could register a client pointing at their own domain. The authorization flow then auto-completed for an already-logged-in user with no consent step, so simply loading the authorization URL issued an authorization code and redirected it to the attacker's URI. Finally, the token minted by the MCP OAuth flow carried the victim's full group set in the JWT, the field used to authorize API paths, so although the token's audience was the requested MCP server, it was accepted across the victim's wider API access. (Obot's JWT verification validated the issuer but not the audience; audiences were enforced at the MCP layer.)
Mitigation
Upgrade to v0.23.0 or later, which adds three protections: a consent screen that shows the requesting client and the MCP server it wants access to before authorization completes; restriction of tokens minted by the MCP OAuth flow to only the MCP involved in the request, so they can no longer reach the user's wider API access; and audience validation as a fail-safe ensuring these tokens are only accepted for the MCP server they were issued for.
Severity
CVSS v3.1 Score: 8.8/10 (High), CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Credits
The Obot team would like to thank @EQSTLab for responsibly disclosing this issue in accordance with our security policy.
Impact
Worst case is that an attacker who gets a logged-in victim to click a crafted link obtains an access token (and refresh token) usable against the API endpoints the victim is authorized for, reading or modifying the victim's resources until the token is revoked. No attacker-side privileges are required.
The application does not correctly enforce access controls, allowing a principal to access resources or operations beyond their granted permissions. Typical impact: unauthorized data access or execution of privileged operations.
GHSA-XWMW-PRC4-V3CR has a CVSS score of 8.8 (High). The vector is network-reachable, no privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (0.23.0); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
Frequently Asked Questions
- What is GHSA-XWMW-PRC4-V3CR? GHSA-XWMW-PRC4-V3CR is a high-severity incorrect authorization vulnerability in github.com/obot-platform/obot (go), affecting versions < 0.23.0. It is fixed in 0.23.0. The application does not correctly enforce access controls, allowing a principal to access resources or operations beyond their granted permissions.
- How severe is GHSA-XWMW-PRC4-V3CR? GHSA-XWMW-PRC4-V3CR has a CVSS score of 8.8 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of github.com/obot-platform/obot are affected by GHSA-XWMW-PRC4-V3CR? github.com/obot-platform/obot (go) versions < 0.23.0 is affected.
- Is there a fix for GHSA-XWMW-PRC4-V3CR? Yes. GHSA-XWMW-PRC4-V3CR is fixed in 0.23.0. Upgrade to this version or later.
- Is GHSA-XWMW-PRC4-V3CR exploitable, and should I be worried? Whether GHSA-XWMW-PRC4-V3CR is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether GHSA-XWMW-PRC4-V3CR is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix GHSA-XWMW-PRC4-V3CR? Upgrade
github.com/obot-platform/obotto 0.23.0 or later.