CVE-2026-79786: Coroot's MCP OAuth registration accepts arbitrary redirect URIs; no fixed release at publication

VulnCheck published CVE-2026-79786 on 2026-08-25 against Coroot, an open-source observability and APM platform whose repository carries roughly 7,900 stars. The record covers the MCP OAuth surface Coroot ships for connecting AI assistants to its data.

Coroot's OAuth dynamic client registration endpoint, POST /oauth/register, accepts any syntactically valid redirect URI with no scheme or domain validation. An unauthenticated attacker can register a client whose redirect URI points at a host they control, then craft an authorization URL for it. When an authenticated Coroot user visits that URL, the authorization endpoint redirects the user's browser, and the authorization response, to the attacker's host. NVD lists the record at 7.0 high. Affected versions are 1.20.2 through 1.24.5.

There is no fixed release. Version 1.24.5, published 2026-08-17, is the newest available and sits inside the affected range. The reporter's public GitHub issue, opened 2026-07-01 and still open as of this writing, states the finding was reported through the vendor's contact form on 2026-05-25 without response; the CVE record followed three months after that first report.

This is the second OAuth dynamic-client-registration record against an MCP surface in a week, after mcp-memory-service's client-credentials bypass (published 2026-08-23, fixed same morning). The failures differ: there the registration endpoint handed out credentials that the token endpoint then honored without authentication; here the unvalidated field is the redirect URI, which turns a legitimate authorization flow into a redirect to a host the attacker registered.