PT-2026-40532 · Npm+1 · @Gitlawb/Openclaude+1

Xanlar Agamalizade · Published 2026-05-12 · Updated 2026-06-02 · CVE-2026-42073

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenClaude versions prior to 0.5.1

Description The MCP authentication flow starts a temporary local HTTP server to handle OAuth callbacks. To prevent Cross-Site Request Forgery (CSRF) attacks, the server validates a state parameter against an internally stored value. A logic flaw in the order of conditionals allows an attacker to bypass this check by providing an error query parameter in the request. When the error parameter is present, the CSRF validation is skipped, and the server executes a cleanup function that shuts down the local server and terminates the user's active authentication session, resulting in a Denial of Service (DoS).

Recommendations Update to version 0.5.1.

Exploit

Fix

DoS

CSRF

Resource Exhaustion

Weakness Enumeration

CWE-352

CWE-400

Related Identifiers

CVE-2026-42073

GHSA-C73C-X77G-854R

Affected Products

@Gitlawb/Openclaude

Openclaude

References · 7

• 🔥 https://github.com/Gitlawb/openclaude/security/advisories/GHSA-c73c-x77g-854r · Exploit
• https://github.com/Gitlawb/openclaude/commit/739b8d1f40fde0e401a5cbd2b9a55d88bd5124ad · Patch
• https://osv.dev/vulnerability/GHSA-c73c-x77g-854r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42073 · Security Note
• https://github.com/Gitlawb/openclaude/releases/tag/v0.5.1 · Note
• https://github.com/Gitlawb/openclaude · Note
• https://t.me/CVEtracker/55642 · Telegram Post