OpenClaude MCP OAuth Callback: State Check Bypass via error Param Leads to DoS

Description

Recommendation

Update the @gitlawb/openclaude package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.5.1
• Patched version(s): 0.5.1

References

• GHSA-c73c-x77g-854r
• CVE-2026-42073
• CWE-352
• CWE-400
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• OpenClaude: Sandbox Bypass via Early-Exit Logic Flaw Allows Path Traversal - CVE-2026-35570
• Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution - CVE-2026-30939
• StudioCMS S3 Storage Manager Authorization Bypass via Missing `await` on Async Auth Check - CVE-2026-32101
• Apify Model Context Protocol (MCP) server: Domain Allowlist Bypass in fetch-apify-docs via String Prefix Matching - CVE-2026-46341

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

CSRF, XXE, and 12 Other Security Acronyms Explained

Update Cheat Sheet for Developers

Tags:

npm

@gitlawb/openclaude