# Obot: OAuth Dynamic Client Registration Enables API Token Theft via Audience Confusion

Unauthenticated dynamic client registration with arbitrary redirect URI plus consent-less auto-approval let an attacker steal a victim's Obot API token via audience confusion.

- Payout: Research
- Severity: high
- Program: Obot
- Found by: EQSTLab, min8282
- Disclosed: 2026-09-18
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-xwmw-prc4-v3cr
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-xwmw-prc4-v3cr
- Tags: area:web domain:api domain:web impact:ato impact:data-leak kind:research platform:ghsa sev:high tech:jwt tech:oauth technique:chained vuln:access-control vuln:auth-bypass

**Target:** OAuth dynamic client registration and MCP OAuth authorization flow in Obot server
**Root cause:** Dynamic client registration was unauthenticated and unrestricted in redirect URI, the authorization flow auto-completed without consent, and MCP-flow JWTs carried the victim's full group set while JWT verification checked issuer but not audience.
**Steps:**
1. Register an OAuth client via the unauthenticated dynamic client registration endpoint with `redirect_uri` pointing at an attacker-controlled domain.
2. Craft an authorization URL for that client requesting an MCP server and send it to a logged-in victim.
3. Victim loads the URL; the flow auto-completes with no consent screen and redirects an authorization code to the attacker's redirect URI.
4. Exchange the code at the token endpoint for an access token (and refresh token).
5. Use the token as a bearer against Obot API endpoints the victim's groups authorize, since audience is not validated.
**How found:** Advisory does not describe the discovery process; the analysis notes the combination of unauthenticated DCR, consent-less auto-approval, and issuer-only JWT validation.
**Exploitation:** Attacker needs no privileges, only a logged-in victim to visit one crafted authorization URL. The stolen code is exchanged for a token minted with the victim's full group set; because JWT verification skipped audience checks, the token works against the victim's wider API access, allowing read/modify of their resources until revocation.
**Escalation:** Token scope exceeded the requested MCP server, granting the victim's full API authorization rather than a single-server scope.
**Insight:** When an OAuth flow mints tokens for a narrow resource (an MCP server), check whether the JWT audience is actually enforced at the API layer — group claims often leak broader authorization than the requested scope.