CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HCVE-2026-42073
Medium (6.5) in gitlawb openclaude. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in @gitlawb/openclaude 0.5.1.
OpenClaude is an open-source coding-agent command line interface for cloud and local model providers. Prior to version 0.5.1, the OpenClaude MCP authentication flow starts a temporary local HTTP server to handle OAuth callbacks. To prevent CSRF attacks, the server validates a state parameter against an internally stored value. However, due to a logic flaw in the order of conditionals, an attacker can completely bypass this check and force the server to shut down — without knowing the state value at all. This issue has been patched in version 0.5.1.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 17% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-352, CWE-400
- Published
- Modified
- Record from
- the NVD, synced
Affected
- gitlawb:openclaude
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-c73c-x77g-854r | npm | @gitlawb/openclaude | <0.5.1 | 0.5.1 |