MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the OAuth error query parameter is passed to CallbackHandler._send_response in oauth_setup.py and interpolated into an HTML page without escaping. A crafted authorization callback can inject markup or script that executes in the browser of a user completing the OAuth flow. This issue is fixed in version 0.22.0.

Affected: PyPI: mcp-atlassian

## Summary

The OAuth 2.0 setup wizard's local callback HTTP server reflects the `error` query parameter directly into an HTML response without any sanitization or encoding. An attacker can craft a malicious callback URL containing JavaScript in the `error` parameter that executes in the victim's browser when the setup wizard is running. The server binds to all network interfaces (`0.0.0.0`), making it accessible from the local network rather than just localhost.

## Details

The vulnerability exists in the `CallbackHandler` class in `src/mcp_atlassian/utils/oauth_setup.py`.

**Step 1 -- Attacker-controlled input enters unsanitized:**

At line 63-66, the `error` query parameter from the URL is read and interpolated into a message string without HTML escaping:

```python # src/mcp_atlassian/utils/oauth_setup.py:63-66 if "error" in params: callback_error = params["error"][0] callback_received = True self._send_response(f"Authorization failed: {callback_error}") ```

**Step 2 -- Unsanitized input is injected into HTML:**

At line 124-125 in `_send_response`, the `message` variable (containing the unescaped attacker input) is injected directly into the HTML template via f-string interpolation:

```python # src/mcp_atlassian/utils/oauth_setup.py:124-125 <div class="message {"success" if status == 200 else "error"}"> <p>{message}</p> </div> ```

**Step 3 -- Server listens on all interfaces:**

At line 167, the callback server binds to all network interfaces, not ju…