CVE-2026-90712 Details

A denial-of-service vulnerability has been identified in Gitlawb OpenClaude versions through 0.30.0. The issue arises in the xAI OAuth Callback Handler, specifically within the waitForCallback function of src/services/api/xaiOAuthCallback.ts. The vulnerability allows remote exploitation by manipulating the error parameter, leading to premature termination of the OAuth authentication process. This issue is an unpatched variant of a previously disclosed vulnerability (CVE-2026-42073) and has been reported to the project, but no response has been received yet.

The vulnerability can be addressed by validating the state parameter before processing error or code parameters in the xAI OAuth Callback Handler. This will ensure that the callback function does not settle the authentication promise without verifying the required state, allowing legitimate callbacks to be processed successfully.