obot-platform/obot Security Advisories | GitStock

high2026-09-18

Obot: Server-Side Request Forgery via remote MCP server URL

GHSA-jgh3-fggc-mcpm

medium2026-09-18

Obot: MCP Registry API readable without authentication

GHSA-pr6h-vr44-xq8j

high2026-09-18

Obot: OAuth Dynamic Client Registration Enables API Token Theft via Audience Confusion

GHSA-xwmw-prc4-v3cr

critical2026-05-13

Obot has an authorization bypass in /mcp-connect/{id} that allows any authenticated user to use any registered MCP server

GHSA-vw82-7fv8-r6gp