This vulnerability affects the waitForCallback function in the src/services/api/xaiOAuthCallback.ts file of Gitlawb openclaude up to version 0.30.0. An attacker can manipulate the Error argument to trigger a denial of service condition remotely. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, and user interaction needed. Public exploit code exists, but no vendor response or patch has been published yet.

Successful exploitation results in denial of service, potentially disrupting the availability of the xAI OAuth Callback Handler component in affected versions of Gitlawb openclaude. There is no indication of privilege escalation, data confidentiality, or integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, monitor official channels for updates. In the meantime, consider limiting exposure of the affected service to untrusted networks and applying network-level protections to reduce attack surface.