CVE-2026-108865: Improper Authentication in AmoyLab Unla

CVE-2026-108865 describes an authentication bypass vulnerability in AmoyLab Unla through version 0.10.0. The OAuth2 server implementation fails to authenticate the resource owner, enabling attackers to register a client, request an authorization code from the /authorize endpoint, and exchange it at the /token endpoint to obtain valid access tokens. These tokens grant unauthorized access to OAuth2-protected MCP prefixes, proxied upstream APIs, and injected credentials, compromising the security of the affected system.

Unauthenticated attackers can bypass authentication controls to obtain valid access tokens, allowing unauthorized access to protected resources and APIs. This can lead to data exposure, unauthorized operations, and potential compromise of upstream services relying on OAuth2 tokens issued by the vulnerable server.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the OAuth2 endpoints and monitor for suspicious client registrations or token requests. Avoid deploying affected versions in production environments where possible.