What is CVE-2026-79786?

CVE-2026-79786 is a high-severity vulnerability in Coroot, classified under URL Redirection to Untrusted Site (Open Redirect). CVSS score: 7.1/10. Published 2026-08-25.

How severe is CVE-2026-79786?

High severity. CVSS v3 base score is 7.1 out of 10.

Open Redirect in Coroot

CVE-2026-79786

Coroot's unauthenticated MCP OAuth dynamic client registration endpoint accepts any syntactically valid redirect URI without validation, allowing attackers to register clients pointing to attacker-controlled hosts. Attackers can send authorization URLs to signed-in users, capture their authorization codes upon consent approval, and exchange them for access tokens to hijack MCP sessions.

Vulnerability class: Open Redirect

Published 2026-08-25 · last modified 2026-09-23.

CVSS v3 metric

CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N.

EPSS exploit prediction

EPSS: 0.003 (18.0th percentile), scored 2026-10-10.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 18th percentile — 18.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.002 · newest: 0.003 · change: +0.001

Affected products

Coroot

Weakness classification (CWE)

CWE-601 — URL Redirection to Untrusted Site (Open Redirect)

References

github.com/coroot/coroot (product)
github.com/coroot/coroot/issues/929 (issue-tracking)
github.com/coroot/coroot/blob/v1.24.5/api/mcp_oauth.go (technical-description)
www.vulncheck.com/advisories/coroot-1.20.2-through-1.24.5-unvalidated-redirect-… (third-party-advisory)

Frequently asked questions

What is CVE-2026-79786?: CVE-2026-79786 is a high-severity vulnerability in Coroot, classified under URL Redirection to Untrusted Site (Open Redirect). CVSS score: 7.1/10. Published 2026-08-25.
How severe is CVE-2026-79786?: High severity. CVSS v3 base score is 7.1 out of 10.