GHSA-XWMW-PRC4-V3CR: OAuth Dynamic Client Registration Enables API Token Theft via Audience Confusion in Obot Platform
Vulnerability ID: GHSA-XWMW-PRC4-V3CR
CVSS Score: 8.8
Published: 2026-09-18
A critical security vulnerability exists in the Obot Platform (versions < 0.23.0) where unauthenticated OAuth dynamic client registration, a consentless authorization flow, and a lack of JWT audience validation enable remote attackers to steal API tokens via audience confusion.
TL;DR
Unauthenticated OAuth client registration and missing audience validation allow attackers to harvest administrative JWTs via a silent, zero-interaction authorization flow redirection.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-863
- Attack Vector: Network
- CVSS Score: 8.8
- EPSS Score: N/A (No CVE Assigned)
- Impact: Remote Code Execution / Privilege Escalation
- Exploit Status: PoC Concept
- KEV Status: Not Listed
Affected Systems
- Obot Platform (github.com/obot-platform/obot) running with OBOT_SERVER_ENABLE_AUTHENTICATION=true
-
obot: < 0.23.0 (Fixed in:
v0.23.0)
Mitigation Strategies
- Disable public access to OAuth registration endpoints
- Enforce network zoning to isolate the Obot server
- Implement administrative review of registered clients
Remediation Steps:
- Upgrade Obot to v0.23.0 or later immediately.
- If upgrade is not possible, implement WAF rules to block POST requests to /oauth/register.
- Review logs for unrecognized OAuth clients.
References
Read the full report for GHSA-XWMW-PRC4-V3CR on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)