CVE-2026-42073: OpenClaude OAuth State Validation Bypass Denial of Service

Technical summary

CVE-2026-42073 describes a logic flaw in OpenClaude's OAuth callback handler prior to version 0.5.1. The temporary HTTP server that receives OAuth responses should validate an incoming state parameter against an internally-stored reference value to mitigate CSRF attacks. A conditional logic error permits attackers to circumvent this validation entirely, allowing them to send a malformed state parameter that causes the server to terminate abnormally. The vulnerability does not require authentication or knowledge of the legitimate state value. The affected CWEs are CWE-352 (Cross-Site Request Forgery) and CWE-400 (Uncontrolled Resource Consumption), reflecting both the validation bypass and the denial-of-service consequence.

Business impact

An attacker exploiting this vulnerability can interrupt OAuth authentication flows for any OpenClaude user, forcing them to restart their authentication attempt. While this does not expose credentials or grant unauthorized access, it creates a denial-of-service condition that degrades user experience and may frustrate adoption of the tool in production environments. Organizations relying on OpenClaude for automated code generation or AI-assisted development may experience workflow disruptions if authentication becomes unreliable. The impact is bounded by the fact that the vulnerability requires user interaction (UI:R) to exploit effectively.

Affected systems

The gitlawb/openclaude project is affected in all versions prior to 0.5.1. This includes the command-line interface and its bundled OAuth callback handler. Any deployment of OpenClaude that uses OAuth authentication against cloud or local model providers is at risk. The vulnerability is most likely to affect developers and DevOps teams using OpenClaude for AI-assisted coding workflows, particularly in organizations integrating the tool into CI/CD pipelines or local development environments.

Exploitability

Exploitation requires network access to the user's local HTTP server (typically localhost) and user interaction to initiate the OAuth flow. An attacker must craft a malicious redirect containing a state parameter designed to trigger the logic flaw. The attack is straightforward to execute once the user is tricked into clicking a link or scanning a malicious QR code, but it is not remotely exploitable without additional attack vectors (e.g., network positioning or social engineering). The CVSS vector AV:N/AC:L/PR:N/UI:R reflects that the vulnerability is reachable over the network with low complexity, but requires user interaction. CVSS score 6.5 (MEDIUM) reflects that impact is limited to availability, not confidentiality or integrity.

Remediation

Update OpenClaude to version 0.5.1 or later. The patch corrects the conditional logic in the state parameter validation routine, ensuring that invalid state values are properly rejected before the server attempts to process the callback. Users should verify the version they are running using the CLI help command or package manager and apply the update during their next maintenance window. No configuration changes are required after patching.

Patch guidance

Download and install OpenClaude 0.5.1 from the official gitlawb/openclaude repository or via your package manager (e.g., pip, npm, or GitHub releases). Verify the integrity of the downloaded binary or package using published checksums if available. Test the patched version in a non-production environment to confirm that OAuth authentication flows complete successfully. Roll out the patch to all systems running OpenClaude, prioritizing development machines and shared CI/CD runners. There are no known breaking changes in version 0.5.1; upgrading should be safe for most deployments.

Detection guidance

Monitor OpenClaude logs for repeated HTTP 400 or 500 errors during OAuth callback handling, which may indicate exploit attempts. Look for error messages related to 'invalid state parameter' or server shutdown events that correlate with unusual network traffic from external sources to the callback handler port. Developers can add debugging output to the OpenClaude configuration to log all incoming state values and their validation results. In a monitoring context, alerting on rapid successive authentication failures or unexpected termination of the OpenClaude callback server may indicate active exploitation attempts, though false positives are possible during legitimate troubleshooting.

Why prioritize this

While this vulnerability has a MEDIUM CVSS score, it should be prioritized for patching because it affects the authentication trust boundary of a development tool used in code generation workflows. Although it does not grant unauthorized access, an attacker can disrupt critical DevOps pipelines that depend on OpenClaude. The simplicity of exploitation (AC:L, PR:N) and the likelihood of user interaction in a development environment make this a practical attack surface. Organizations where OpenClaude is embedded in build processes or local development should prioritize version 0.5.1 within 30 days; casual users can absorb it into standard update cycles.

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM severity) is driven by high availability impact (A:H) in a scenario where the attacker can force repeated service interruptions, balanced against the requirement for user interaction (UI:R) and network access to a local service (AV:N but typically scoped to localhost). The vulnerability does not affect confidentiality (C:N) or integrity (I:N), so it does not result in a HIGH score. The presence of this flaw in the authentication boundary, combined with the low barrier to exploitation, justifies a MEDIUM rather than LOW classification despite the limited scope of impact.

Frequently asked questions