CVE-2026-42073 Details

A vulnerability in OpenClaude's MCP authentication flow allows for an OAuth state validation bypass, leading to a denial-of-service condition. The issue arises because the authentication process relies on a temporary local HTTP server to manage OAuth callbacks. To mitigate CSRF attacks, the server checks the 'state' parameter against a stored value. However, a logic flaw in the conditional checks enables an attacker to bypass this validation entirely. By sending a request with an 'error' parameter, the attacker can force the server to shut down, disrupting the user's authentication session without needing to know the 'state' value.

Users can update to OpenClaude version 0.5.1, which addresses this vulnerability by repositioning the state validation check to occur before any error parameters are processed.