Summary
AmoyLab Unla through 0.10.0 contains an OAuth2 authentication bypass that can allow unauthenticated attackers to obtain valid access tokens. With access to the OAuth2 endpoints, an attacker may reach protected MCP prefixes, proxied upstream APIs, and injected credentials.
AmoyLab Unla through 0.10.0 contains an OAuth2 authentication bypass that can allow unauthenticated attackers to obtain valid access tokens. With access to the OAuth2 endpoints, an attacker may reach protected MCP prefixes, proxied upstream APIs, and injected credentials.
Affected context
The vulnerability occurs in deployments of AmoyLab Unla where the OAuth2 server processes authorization requests without authenticating the resource owner. It becomes risky when the /authorize and /token endpoints are reachable and their issued tokens protect MCP prefixes, upstream APIs, or credential-bearing integrations.
The vulnerability occurs in deployments of AmoyLab Unla where the OAuth2 server processes authorization requests without authenticating the resource owner. It becomes risky when the /authorize and /token endpoints are reachable and their issued tokens protect MCP prefixes, upstream APIs, or credential-bearing integrations.
Exploit preconditions
- Attack surface: OAuth2 authorization and token endpoints, including
/authorizeand/token - Required access: No prior authentication is required; network access to the OAuth2 service is generally sufficient
- Trigger point: Client registration, authorization-code issuance, and token exchange
- Why exploitation is possible: The OAuth2 server does not verify the identity or consent of the resource owner before issuing an authorization code and access token
- Attack surface: OAuth2 authorization and token endpoints, including
/authorizeand/token - Required access: No prior authentication is required; network access to the OAuth2 service is generally sufficient
- Trigger point: Client registration, authorization-code issuance, and token exchange
- Why exploitation is possible: The OAuth2 server does not verify the identity or consent of the resource owner before issuing an authorization code and access token
Why this happens
The underlying defect is a failure to authenticate the resource owner during the OAuth2 authorization flow. This allows an unauthenticated party to progress through a flow intended for an authenticated user and receive a token representing access that was never properly authorized. The behavior maps to CWE-287: Improper Authentication, because the system accepts an authentication or authorization result without adequately verifying the required identity.
The underlying defect is a failure to authenticate the resource owner during the OAuth2 authorization flow. This allows an unauthenticated party to progress through a flow intended for an authenticated user and receive a token representing access that was never properly authorized. The behavior maps to CWE-287: Improper Authentication, because the system accepts an authentication or authorization result without adequately verifying the required identity.
Potential impact
- Attackers may obtain valid OAuth2 access tokens without authenticating
- Protected MCP prefixes may be accessed or manipulated
- Proxied upstream APIs may be called with unauthorized permissions
- Injected or stored credentials may be exposed or misused
- Downstream data and integrations could be modified, disrupted, or abused
- Attackers may obtain valid OAuth2 access tokens without authenticating
- Protected MCP prefixes may be accessed or manipulated
- Proxied upstream APIs may be called with unauthorized permissions
- Injected or stored credentials may be exposed or misused
- Downstream data and integrations could be modified, disrupted, or abused
General mitigation guidance
Mitigation generally focuses on making resource-owner authentication and authorization mandatory before issuing authorization codes or tokens.
Common defensive patterns include:
- Require verified resource-owner authentication and explicit consent in authorization flows
- Apply strict redirect URI, client registration, scope, and audience validation
- Use secure-by-default OAuth2 authorization-code settings and avoid implicit trust in unauthenticated requests
- Separate client authentication from resource-owner authentication rather than treating registration as authorization
- Limit token scopes, lifetime, and access to upstream integrations according to least privilege
- Protect credential-injection and proxy features with independent authorization checks
- Enforce centralized policy controls, rate limits, and monitoring around token issuance
Mitigation generally focuses on making resource-owner authentication and authorization mandatory before issuing authorization codes or tokens.
Common defensive patterns include:
- Require verified resource-owner authentication and explicit consent in authorization flows
- Apply strict redirect URI, client registration, scope, and audience validation
- Use secure-by-default OAuth2 authorization-code settings and avoid implicit trust in unauthenticated requests
- Separate client authentication from resource-owner authentication rather than treating registration as authorization
- Limit token scopes, lifetime, and access to upstream integrations according to least privilege
- Protect credential-injection and proxy features with independent authorization checks
- Enforce centralized policy controls, rate limits, and monitoring around token issuance
How teams detect issues like this
Detection can include static analysis and code review for authorization handlers that issue codes or tokens without invoking resource-owner authentication or consent checks. Reviewers can examine client-registration logic, redirect validation, scope enforcement, and whether token claims are derived from a verified identity rather than request parameters.
Runtime monitoring may flag token issuance without a corresponding authenticated session, unusual client-registration volume, repeated authorization requests, unexpected scopes, or access to protected MCP and upstream resources by newly created clients. Policy enforcement in CI can require OAuth2 flow tests that prove unauthenticated requests cannot obtain usable tokens.
Detection can include static analysis and code review for authorization handlers that issue codes or tokens without invoking resource-owner authentication or consent checks. Reviewers can examine client-registration logic, redirect validation, scope enforcement, and whether token claims are derived from a verified identity rather than request parameters.
Runtime monitoring may flag token issuance without a corresponding authenticated session, unusual client-registration volume, repeated authorization requests, unexpected scopes, or access to protected MCP and upstream resources by newly created clients. Policy enforcement in CI can require OAuth2 flow tests that prove unauthenticated requests cannot obtain usable tokens.
