PkgSeer

Vulnerability GO-2026-5678

Unknown

3 months ago

Obot has an authorization bypass in /mcp-connect/{id} that allows any authenticated user to use any registered MCP server in github.com/obot-platform/obot

v0.1.0-rc1 - v0.21.1-rc3

Summary

Obot has an authorization bypass in /mcp-connect/{id} that allows any authenticated user to use any registered MCP server in github.com/obot-platform/obot

Details

Obot has an authorization bypass in /mcp-connect/{id} that allows any authenticated user to use any registered MCP server in github.com/obot-platform/obot

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Obot: Server-Side Request Forgery via remote MCP server URL

v0.1.0-rc1 - v0.23.0-rc5 GHSA-jgh3-fggc-mcpm

Obot: MCP Registry API readable without authentication

v0.1.0-rc1 - v0.23.0-rc5 GHSA-pr6h-vr44-xq8j

Obot: OAuth Dynamic Client Registration Enables API Token Theft via Audience Confusion

v0.1.0-rc1 - v0.23.0-rc5 GHSA-xwmw-prc4-v3cr

Obot has an authorization bypass in /mcp-connect/{id} that allows any authenticated user to use any registered MCP server

v0.1.0-rc1 - v0.21.1-rc3 GHSA-vw82-7fv8-r6gp

View all vulnerabilities for these packages

Impacted packages

github.com/obot-platform/obot

Timeline

Published

3 months ago

Last Modified

3 hours ago