AmyoLab Unla OAuth2 Authentication Bypass via /authorize Endpoint Analysis

CVE-2026-108865: AmyoLab Unla through 0.10.0 OAuth2 Authentication Bypass via /authorize Vulnerability Overview AmyoLab Unla is a self-hosted MCP gateway. When OAuth2 is enabled, it runs an OAuth 2.0 authorization server and can configure MCP route prefixes to use the OAuth2 authentication mode, requiring bearer tokens for requests to those prefixes. The authorization code flow lacks a resource owner. The endpoint issues an authorization code after only checking the client and redirect URI, both of which are provided by the caller. The stored code and the issued token carry the client ID and scope, but no user identity. The MCP gateway accepts any token that exists in storage and has not expired for MCP routes configured with OAuth2, without verifying which client the token belongs to or the associated prefix. Consequently, any anonymous network caller able to reach the OAuth endpoints can register a client via , obtain an authorization code via using their own redirect URI, and exchange that code for an access token via . No account involvement, victim interaction, or consent steps are required when creating credentials. The crossed trust boundary is from an anonymous network caller to MCP routes protected by OAuth2 mode configuration. The specific impact is unauthorized access to MCP routes and upstream resources protected by OAuth2 mode configuration, limited to exposed tools. The prerequisite is that OAuth2 is enabled and the target prefix is set to OAuth2, which represents the intended secure configuration of the feature rather than an operator error. Affected Scope Affected Versions: AmyoLab/Unla, a self-hosted MCP gateway featuring an OAuth2 authorization server and MCP route gateway. Affected Commits: From (reviewed as v0.10.0) to the current , as of 2026-10-11. The earliest affected version is undetermined. Category: CVE-862 Missing Authorization, CVE-863 Incorrect Authorization Status: Source code review, static-only. Coordinated disclosure is pending. CVE has not yet been assigned. Remediation Remediation Status: No specific remediation has been provided. Detailed Attack Steps 1. OAuth Routes Mounted Without Authentication Middleware: The OAuth endpoints are mounted within the OAuth2-enabled branch. The group includes only optional CORS middleware. No authentication middleware is attached. 2. Client Registration Returns Credentials to Any Caller: passes the request directly to the auth service. decodes the body, requires only the existence of a redirect URI, generates a client ID and secret, stores the client, and returns both credentials. 3. Authorization Endpoint Issues Code Without Resource Owner or Consent: handles two methods. The GET branch renders a static page. The POST branch copies form fields to the request query, calls , and redirects to the caller-provided redirect URI with the code. The page rendering sets no session and checks for no identity. 4. Token Exchange Uses Caller's Own Client and Code: delegates to . compares the client secret with an equality check, then dispatches to the authorization code grant. 5. MCP Gateway Accepts Any Existing and Unexpired Token: The root handler is registered as a no-route handler. extracts the prefix, reads its auth configuration, and calls when the mode is OAuth2. Verification Verification Steps: The vulnerability is verified through the attack steps described above. Impact and Limitations Impact: Anonymous network callers can access MCP routes and upstream resources protected by OAuth2 mode configuration. Limitations: Limited to exposed tools. Remediation Remediation Status: No specific remediation has been provided. References Reporter: hieuPenguinnn, github.com/hieuPenguinnn Project: AmyoLab/Unla, a self-hosted MCP gateway featuring an OAuth2 authorization server and MCP route gateway.

Goal Reached Thanks to every supporter — we hit 100%!

AmyoLab Unla OAuth2 Authentication Bypass via /authorize Endpoint Analysis

More from this source