Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-101059

utcp-http before 1.1.4 OAuth2 tokenUrl Trust Boundary Bypass

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

utcp-http before 1.1.4 fails to validate the OAuth2 tokenUrl field from remote OpenAPI specifications, allowing attackers to redirect credential submission to arbitrary endpoints. When a victim registers an attacker-controlled OpenAPI spec and invokes a generated OAuth2-protected tool, the library POSTs the victim's client_id and client_secret to the attacker-supplied token endpoint without URL validation.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

universal-tool-calling-protocol python-utcp

Default version status: unaffected

  • 0 to < 1.1.4affected
  • 1.1.4unaffected
pkg:pypi/utcp-http

References