CVE-2026-81836 in Roo-Code
Summary
by MITRE • 08/28/2026
A vulnerability was detected in RooCodeInc Roo-Code up to 3.51.1. This vulnerability affects unknown code of the file src/integrations/claude-code/oauth.ts of the component OAuth Callback. The manipulation results in cleartext transmission of sensitive information. The attack may be performed from remote. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The exploit is now public and may be used. Multiple isses were reported to the vendor beforehand. They explain, that "they all apply to Roo Code, a project we no longer support - the repository was archived a while ago, and we don't encourage anyone to use it." This vulnerability only affects products that are no longer supported by the maintainer.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/28/2026
The identified security flaw resides within the OAuth callback implementation of RooCodeInc Roo-Code versions up to 3.51.1, specifically affecting the code located in src/integrations/claude-code/oauth.ts. This vulnerability is classified as a cleartext transmission of sensitive information, which aligns with CWE-319 in the Common Weakness Enumeration taxonomy. The core technical issue involves the improper handling or configuration of authentication flows where credentials, tokens, or session data are transmitted over unencrypted channels rather than through secure protocols such as HTTPS. This failure to enforce encryption during critical identity verification steps exposes users to significant risks including credential theft and session hijacking if an attacker can intercept network traffic between the client application and the OAuth provider.
From a tactical perspective, this vulnerability allows for remote exploitation by attackers who possess the capability to perform man-in-the-middle attacks or monitor local network traffic. The complexity of exploiting this flaw is rated as high due to specific environmental requirements such as being on the same unsecured network segment or having access to routing infrastructure that permits packet interception. Despite the high complexity, the exploitability remains difficult for most adversaries because it requires active position in the communication path and often relies on social engineering or compromised network devices to succeed effectively. However, the fact that public exploits are available significantly lowers the barrier to entry for less sophisticated threat actors who may leverage existing tooling rather than developing custom attack vectors from scratch.
The operational impact of this vulnerability is severe for any organization or individual continuing to use archived versions of Roo-Code. Since sensitive authentication data such as access tokens and refresh secrets are exposed in plaintext, an attacker can potentially gain unauthorized access to linked services like Claude Code accounts. This leads directly to a compromise of confidentiality and integrity within the affected user environment. The lack of encryption means that even if multi-factor authentication is enabled at the provider level, the initial token exchange phase remains vulnerable to interception before additional security layers are engaged or validated by the application logic.
It is critical to note that RooCodeInc has officially archived this repository and no longer provides support for these versions. The vendor explicitly states that they do not encourage anyone to use the software due to multiple reported issues, including this vulnerability. Consequently, traditional mitigation strategies such as applying patches are unavailable because no further updates will be released by the maintainer. Organizations or individuals relying on this specific version must treat it as end-of-life from a security maintenance standpoint and immediately discontinue its usage in any production or sensitive environment.
To mitigate the risks associated with this vulnerability, users should migrate to supported alternatives that adhere to modern security standards for authentication flows. If migration is not immediately feasible, strict network segmentation and the use of encrypted communication channels where possible can reduce exposure, though these are imperfect workarounds given the fundamental design flaw in the OAuth implementation. Security teams should also monitor ATT&CK techniques related to credential interception such as T1048 Exfiltration Over Alternative Protocol or T1557 Adversary-in-the-Middle to enhance detection capabilities for any potential exploitation attempts targeting legacy systems that may still be running vulnerable versions of this software.