CVE-2026-77272: mcp-atlassian Reflected XSS in OAuth Setup Callback Handler
Summary
CVE-2026-77272: MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler. Affects mcp-atlassian versions < 0.22.0. Fixed in 0.22.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
MCP Atlassian is a package designed to facilitate OAuth 2.0 setup for applications, providing a streamlined process for integrating third-party authentication. It includes a local callback HTTP server that handles authorization responses. However, due to a lack of input sanitization, it is vulnerable to reflected cross-site scripting (XSS) attacks, which can compromise user security during the OAuth setup process.
Vulnerability Detail
The vulnerability arises from the OAuth 2.0 setup wizard's local callback HTTP server reflecting the 'error' query parameter directly into an HTML response without proper sanitization or encoding. An attacker can exploit this by crafting a malicious callback URL containing JavaScript in the 'error' parameter, which executes in the victim's browser when the setup wizard is active. The server listens on all network interfaces, making it accessible from the local network, thus increasing the risk of exploitation. The absence of security headers further exacerbates the issue, allowing for potential JavaScript execution in the victim's browser context.
How To Fix
Latest published version: 0.23.1 as of 23 Oct 2026
pip install --upgrade "mcp-atlassian==0.23.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.22.0
This is the first release that contains the fix.
pip install --upgrade "mcp-atlassian==0.22.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the callback server by configuring your firewall to allow connections only from localhost or by using a VPN to limit access to trusted networks. Additionally, avoid running the OAuth setup wizard on public networks.
Conclusion
The CVE-2026-77272 vulnerability in the mcp-atlassian package poses a significant risk due to its potential for XSS attacks during the OAuth setup process. It is crucial to update to the patched version and implement recommended security measures to protect against exploitation.
See every vulnerability recorded for mcp-atlassian →
FAQ
CVE-2026-77272 is a vulnerability in the mcp-atlassian package that allows for reflected cross-site scripting (XSS) attacks during the OAuth setup process.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your application without needing to sign up.
The vulnerability can lead to JavaScript execution in the victim's browser, allowing attackers to steal sensitive information such as cookies or manipulate OAuth authorization codes.
You can update the package by running the command 'pip install --upgrade mcp-atlassian' in your terminal.
If immediate updates are not possible, consider implementing firewall rules to restrict access to the callback server and avoid running the OAuth setup wizard on public networks.
References
Related vulnerabilities
Recent vulnerabilities recorded for mcp-atlassian.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
