This vulnerability arises from three combined issues in Obot <= v0.22.1 with authentication enabled: unauthenticated OAuth dynamic client registration allowing arbitrary redirect URIs; an authorization flow that auto-completes without a consent screen for logged-in users; and tokens minted with the victim's full group set but lacking audience validation at the token verification layer. An attacker can register a malicious OAuth client and trick a logged-in user into visiting a crafted authorization URL, resulting in the attacker obtaining an authorization code and access token with the victim's full API access. The token's audience is not properly validated, allowing it to be used beyond the intended MCP server. The vulnerability has a CVSS 3.1 score of 8.8 (High).

An attacker who convinces a logged-in victim to visit a malicious authorization URL can obtain an access token and refresh token usable against all API endpoints the victim has access to. This allows the attacker to read or modify the victim's resources without requiring any privileges on the attacker side. The tokens carry the victim's full group permissions, leading to potentially broad unauthorized access until tokens are revoked.

Upgrade to Obot version 0.23.0 or later. The update introduces a consent screen that displays the requesting client and MCP server before authorization completes, restricts tokens to the MCP server involved in the request, and enforces audience validation to ensure tokens are only accepted for their intended MCP server. These protections prevent unauthorized token issuance and misuse. No other mitigation is required if updated.