Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Coroot's unauthenticated MCP OAuth dynamic client registration endpoint accepts any syntactically valid redirect URI without validation, allowing attackers to register clients pointing to attacker-controlled hosts. Attackers can send authorization URLs to signed-in users, capture their authorization codes upon consent approval, and exchange them for access tokens to hijack MCP sessions.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-79786 Coroot's unauthenticated MCP OAuth dynamic client registration endpoint accepts any syntactically valid redirect URI without validation, allowing attackers to registe… https://www.cve.org/CVERecord?id=CVE-2026-79786
Post summary
The CVE reveals that Coroot’s MCP OAuth dynamic client registration endpoint lacks redirect URI validation, potentially allowing attackers to register arbitrary redirect URIs.
🚨*CVE* CVE-2026-79786 Coroot's unauthenticated MCP OAuth dynamic client registration endpoint accepts any syntactically valid redirect URI without validation, allowing attackers to registe… https://www.cve.org/CVERecord?id=CVE-2026-79786 ----- Traducción: CVE-2026-79786 Cor… https://infoflow.cloud`
Post summary
The text announces CVE‑2026‑79786 and explains that it is an unauthenticated OAuth endpoint flaw that accepts any redirect URI, but contains no PoC, exploit code, or patch information.