GHSA-8cp3-qxj6-px34

### Summary The `utcp-http` library (<= 1.1.3) unconditionally trusts the `tokenUrl` field embedded in remote OpenAPI security schemes. When a victim registers an attacker-controlled OpenAPI spec and invokes any generated OAuth2-protected tool, the library POSTs the victim's `client_id` and `client_secret` to the attacker-supplied token endpoint without any URL validation. The same `ensure_secure_url()` guard applied to discovery URLs and tool invocation URLs is absent for the OAuth2 token endpoint, creating a credential-exfiltration path. ### Details `utcp-http` supports automatic tool generation from remote OpenAPI specifications. During conversion, `OpenApiConverter._extract_auth()` reads OAuth2 flow configuration directly from the spec: ```python # openapi_converter.py:369-377 token_url = flow_config.get("tokenUrl") # untrusted source - no validation ... return OAuth2Auth( token_url=token_url, # stored verbatim ... ) ``` The generated `HttpCallTemplate` carries this `OAuth2Auth` object. At call time, `HttpCommunicationProtocol._handle_oauth2()` forwards credentials to that URL: ```python # http_communication_protocol.py:376 async with session.post(auth_details.token_url, data=body_data) as response: ``` By contrast, the discovery URL and the tool invocation URL are both validated before use: ```python # http_communication_protocol.py:129 ensure_secure_url(url, context="manual discovery") # http_communication_protocol.py:281 ensure_secure_url(url, context="tool invocation") ``` The `ensure_secure_url()` function (defined in `_security.py:96-112`) rejects plain-HTTP non-loopback URLs and known internal address ranges. Because this check is never called on `auth_details.token_url`, an attacker can direct credential submission to any reachable endpoint - an external HTTPS server for direct credential theft, or an internal HTTP endpoint for SSRF. **Full data flow (source to sink):** 1. `http_communication_protocol