CVE-2026-42073

# OAuth State Validation Bypass via `error` Parameter Causes Local Server DoS in MCP Auth Callback --- ## Description The OpenClaude MCP authentication flow starts a temporary local HTTP server to handle OAuth callbacks. To prevent CSRF attacks, the server validates a `state` parameter against an internally stored value. However, due to a logic flaw in the order of conditionals, an attacker can completely bypass this check and force the server to shut down — without knowing the `state` value at all. The vulnerable code looks like this: ```typescript if (!error && state !== oauthState) { rejectOnce(new Error('OAuth state mismatch - possible CSRF attack')) return } if (error) { cleanup() rejectOnce(new Error(errorMessage)) return } ``` When a request arrives with an `error` query parameter (e.g., `?error=anything`), the first condition becomes `false` because `!error` evaluates to `false`. This means the CSRF check is **never reached**. Execution falls through to the second block, where `cleanup()` is called — shutting down the local server and terminating the user's active authentication session. The attacker does not need to know the `state` value. Any request containing an `error` parameter is enough to trigger the shutdown. --- ## Impact - The user's OAuth flow is silently terminated mid-session - The local callback server is shut down (Denial of Service) - Can be triggered remotely via a malicious web page using a cross-origin request (CSRF) - No authentication or prior knowledge of the `state` value is required --- ## Steps to Reproduce Save the following as `poc.js` and run with Node.js: ```javascript import { createServer } from 'http'; import { parse } from 'url'; const expectedState = "secure_state_abc123"; const server = createServer((req, res) => { const parsedUrl = parse(req.url || '', true); const { pathname, query } = parsedUrl; const { state, error } = query; if (pathname === '/callback') {