PYSEC-2026-4093 MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler

Summary The OAuth 2.0 setup wizard's local callback HTTP server reflects the error query parameter directly into an HTML response without any sanitization or encoding. An attacker can craft a malicious callback URL containing JavaScript in the error parameter that executes in the victim's browser...

PT-2026-105846

Summary The OAuth 2.0 setup wizard's local callback HTTP server reflects the error query parameter directly into an HTML response without any sanitization or encoding. An attacker can craft a malicious callback URL containing JavaScript in the error parameter that executes in the victim's browser...

CVE-2026-77272 MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the OAuth error query parameter is passed to CallbackHandler.sendresponse in oauthsetup.py and interpolated into an HTML page without escaping. A crafted authorization callback can...

CVE-2026-77272 MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the OAuth error query parameter is passed to CallbackHandler.sendresponse in oauthsetup.py and interpolated into an HTML page without escaping. A crafted authorization callback can...

CVE-2026-77272 MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the OAuth error query parameter is passed to CallbackHandler.sendresponse in oauthsetup.py and interpolated into an HTML page without escaping. A crafted authorization callback can...

Reflected XSS from the callback handler's error query parameter

Overview Overview @auth0/nextjs-auth0 versions before and including 1.4.1 are vulnerable to reflected XSS. An attacker can execute arbitrary code by providing an XSS payload in the error query parameter which is then processed by the callback handler as an error message. Am I affected? You are...

Reflected XSS from the callback handler's error query parameter

Overview Versions before and including 1.4.1 are vulnerable to reflected XSS. An attacker can execute arbitrary code by providing an XSS payload in the error query parameter which is then processed by the callback handler as an error message. Am I affected? You are affected by this vulnerability ...

GHSA-954C-JJX6-CXV7 Reflected XSS from the callback handler's error query parameter

Overview Versions before and including 1.4.1 are vulnerable to reflected XSS. An attacker can execute arbitrary code by providing an XSS payload in the error query parameter which is then processed by the callback handler as an error message. Am I affected? You are affected by this vulnerability ...

CVE-2021-32702

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before and including 1.4.1 are vulnerable to reflected XSS. An attacker can execute arbitrary code by providing an XSS payload in the error query parameter which is then processed by the...

CVE-2021-32702

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before and including 1.4.1 are vulnerable to reflected XSS. An attacker can execute arbitrary code by providing an XSS payload in the error query parameter which is then processed by the...

CVE-2021-32702

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before and including 1.4.1 are vulnerable to reflected XSS. An attacker can execute arbitrary code by providing an XSS payload in the error query parameter which is then processed by the...

PT-2021-19868

Name of the Vulnerable Software and Affected Versions @auth0/nextjs-auth0 versions prior to 1.4.2 Description The issue concerns a reflected XSS vulnerability. An attacker can execute arbitrary code by providing an XSS payload in the error query parameter, which is then processed by the callback...

CVE-2021-32702: Improper Neutralization of Input During Web Page Generation

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before and including 1.4.1 are vulnerable to reflected XSS. An attacker can execute arbitrary code by providing an XSS payload in the error query parameter which is then processed by the...