# AI Playground XSS to steal user-chat messages and access to connected MCP Server

Reflected XSS in Cloudflare AI Playground OAuth handler via unescaped error_description in a script tag, letting attackers read chat history and act on connected MCP servers.

- Payout: hidden
- Severity: low
- Program: Cloudflare Public Bug Bounty
- Found by (vendor credit): Nishant Kumawat
- Found by: matured_kazama
- Disclosed: 2026-02-26
- CVE: CVE-2026-1721
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/3424998
- Library page: https://bugbountylibrary.com/r/h1%3A3424998
- Tags: area:web domain:web impact:ato impact:data-leak kind:bounty platform:hackerone sev:low tech:oauth technique:chained vuln:xss

**Target:** AI Playground OAuth callback handler (error_description parameter)
**Root cause:** The OAuth handler interpolates the error_description parameter into a <script> tag without escaping, allowing script injection.
**Steps:**
1. Craft an OAuth error redirect with a malicious `error_description` payload containing script-breaking characters
2. Send the crafted link to a victim (phishing)
3. Victim clicks; injected JavaScript executes in the AI Playground origin
4. Script reads session-based chat history and issues requests to connected MCP servers as the victim
**Exploitation:** Attacker delivers a crafted OAuth error URL; upon victim click, injected JS runs in the Playground origin, exfiltrating chat messages and invoking MCP server actions under the victim's session.
**Escalation:** Chained XSS with MCP server access to act on the victim's behalf beyond simple data theft.
**Insight:** OAuth error-handling endpoints that reflect error_description into inline scripts are a recurring XSS sink; test callback/error paths, not just success flows, and check whether the resulting session can drive privileged integrations like MCP servers.