https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 19:42:11 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-101059 <p>utcp-http before 1.1.4 fails to validate the OAuth2 tokenUrl field from remote OpenAPI specifications, allowing attackers to redirect credential submission to arbitrary endpoints. When a victim registers an attacker-controlled OpenAPI spec and invokes a generated OAuth2-protected tool, the library POSTs the victim&#39;s client_id and client_secret to the attacker-supplied token endpoint without URL validation.</p> <p>utcp-http before 1.1.4 fails to validate the OAuth2 tokenUrl field from remote OpenAPI specifications, allowing attackers to redirect credential submission to arbitrary endpoints. When a victim registers an attacker-controlled OpenAPI spec and invokes a generated OAuth2-protected tool, the library POSTs the victim&#39;s client_id and client_secret to the attacker-supplied token endpoint without URL validation.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-101059 https://vulnerability.circl.lu/vuln/ghsa-r549-qqpm-phj8 <p>utcp-http before 1.1.4 fails to validate the OAuth2 tokenUrl field from remote OpenAPI specifications, allowing attackers to redirect credential submission to arbitrary endpoints. When a victim registers an attacker-controlled OpenAPI spec and invokes a generated OAuth2-protected tool, the library POSTs the victim&#39;s client_id and client_secret to the attacker-supplied token endpoint without URL validation.</p> <p>utcp-http before 1.1.4 fails to validate the OAuth2 tokenUrl field from remote OpenAPI specifications, allowing attackers to redirect credential submission to arbitrary endpoints. When a victim registers an attacker-controlled OpenAPI spec and invokes a generated OAuth2-protected tool, the library POSTs the victim&#39;s client_id and client_secret to the attacker-supplied token endpoint without URL validation.</p> https://vulnerability.circl.lu/vuln/ghsa-r549-qqpm-phj8