A vulnerability was detected in RooCodeInc Roo-Code up to 3.51.1. (CVE-2026-81836)
Description
A vulnerability in RooCodeInc Roo-Code up to version 3.51.1 allows remote attackers to cause cleartext transmission of sensitive information via the OAuth Callback component. The vulnerability is difficult to exploit and has low severity. The product is no longer supported or maintained by the vendor, who advises against its use.
CVSS v3.1
Score 3.7low
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects an unknown code segment in the file src/integrations/claude-code/oauth.ts of the OAuth Callback component in RooCodeInc Roo-Code versions up to 3.51.1. The issue results in sensitive information being transmitted in cleartext, potentially exposing it to interception. The attack requires high complexity and no privileges or user interaction. The vendor has archived the project and no longer supports it, recommending users not to use the product. No patch or fix is available, and the exploit is publicly known but difficult to execute.
Potential Impact
The vulnerability allows remote attackers to intercept sensitive information transmitted in cleartext, which could lead to information disclosure. However, the attack complexity is high, and the overall severity is low. There is no impact on integrity or availability. Since the product is unsupported, no official remediation is provided.
Mitigation Recommendations
The vendor no longer supports RooCodeInc Roo-Code and does not provide patches or fixes for this vulnerability. Users are advised to discontinue use of this product and migrate to supported alternatives. Patch status is not confirmed due to lack of vendor support.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-57j6-cfwj-h582
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-81836"]
- Database Specific Severity
- LOW
- Cvss Version
- 3.1
Threat ID: 6a91a7e0acd9273b49065940
Added to database: 08/28/2026, 15:23:12 UTC
Last enriched: 09/10/2026, 00:08:11 UTC
Last updated: 10/13/2026, 18:48:24 UTC
Views: 58
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.