OpenClaude's MCP authentication flow uses a temporary local HTTP server to handle OAuth callbacks, validating a state parameter to prevent CSRF attacks. Due to a logic error in the conditional checks, attackers can bypass this validation and cause the server to shut down unexpectedly. This denial-of-service condition affects versions before 0.5.1. The vulnerability is tracked as CVE-2026-42073 with a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). The issue has been fixed in OpenClaude version 0.5.1.

The vulnerability allows an unauthenticated remote attacker to bypass CSRF protections and forcibly shut down the local HTTP server used in the OAuth authentication flow. This results in a denial-of-service condition impacting availability. There is no impact on confidentiality or integrity according to the CVSS vector. No known exploits are reported in the wild.

Upgrade OpenClaude to version 0.5.1 or later, where this vulnerability has been patched. Since this is a client-side CLI tool and not a cloud service, users must apply the update themselves. Patch status is confirmed by the vendor stating the fix is included in version 0.5.1. No additional mitigations are indicated.