mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-25 05:00:07 +00:00
Oliver Kieselbach
c20d9df8dc
Medium finding: the anonymous dynamic-client-registration allowlist accepted any path on whole vendor domains plus wildcard subdomains, so an open redirect (or controllable subdomain) on an allowed domain could exfiltrate authorization codes — PKCE does not help when the attacker runs the flow with their own verifier. Defaults are now the documented callback URIs only (claude.ai + claude.com /api/mcp/auth_callback, chatgpt.com /connector_platform_oauth_redirect, vscode.dev + insiders.vscode.dev /redirect); gemini.google.com dropped (Gemini CLI uses loopback). MCP_ALLOWED_REDIRECT_HOSTS gains optional /path templates (host-only entries still work). redirect_uris with userinfo or fragments are rejected outright, loopback included; localhost stays allowed because Claude Code and Gemini CLI register http://localhost callbacks. Low finding: /oauth/token now sets Cache-Control: no-store + Pragma: no-cache on every response; Entra error logging is reduced to status/error/error_codes/ correlation_id; all user-controlled log fields (client_name, redirect_uri) pass through sanitizeForLog (control-char strip + length cap). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>