Obot versions before 0.23.0 running with authentication enabled expose an OAuth dynamic client registration endpoint that requires no authentication and imposes no restrictions on redirect URIs. An attacker can register a client with a redirect URI under their control and lure a logged-in user to authorize it via a crafted URL. Because the authorization flow auto-completes without user consent and obot only validates the token issuer (not audience), the attacker receives an authorization code and exchanges it for a token that carries the victim's full group membership. This token can be used as a bearer token against any obot API endpoint accessible by the victim, enabling unauthorized reading or modification of the victim's resources. The fix in version 0.23.0 introduces a consent screen, audience validation, and token scoping to the MCP server involved in the request.

An attacker can obtain OAuth tokens with the full privileges of a logged-in victim without their explicit consent, enabling unauthorized access and modification of the victim's resources on any obot API endpoint the victim can access. This compromises confidentiality and integrity of user data and resources until the token is revoked.

Upgrade obot to version 0.23.0 or later, which adds a consent screen, restricts OAuth tokens to the MCP server involved, and enforces audience validation. These changes prevent unauthorized client registration and token misuse. Until upgraded, avoid enabling OBOT_SERVER_ENABLE_AUTHENTICATION or restrict access to the dynamic client registration endpoint if possible. Patch status is confirmed by the vendor's release of version 0.23.0.