utcp-http POSTs your client_secret to whatever token endpoint a remote OpenAPI spec names

GitHub Advisory Database·medium signalXBlueskyLinkedInCopy link

GHSA-8cp3-qxj6-px34 (high, 25 Aug) covers utcp-http <= 1.1.3, where `OpenApiConverter._extract_auth()` reads the OAuth2 `tokenUrl` straight out of a remote spec and never validates it. The `ensure_secure_url()` guard the library applies to discovery URLs and tool invocation URLs is simply absent on the token endpoint, so registering an attacker-controlled OpenAPI spec and invoking any generated OAuth2 tool exfiltrates `client_id` and `client_secret`. Two companion advisories landed the same hour: utcp-http follows redirects without re-validating the target (SSRF), and the CVE-2026-44661 SSRF fix was never applied to the GraphQL and WebSocket plugins.