Gitlawb openclaude up to 0.5.0 state cross-site request forgery

Summaryinfo

A vulnerability identified as problematic has been detected in Gitlawb openclaude up to 0.5.0. This affects an unknown function. Performing a manipulation of the argument state results in cross-site request forgery. This vulnerability was named CVE-2026-42073. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Gitlawb openclaude up to 0.5.0. This affects some unknown functionality. The manipulation of the argument state with an unknown input leads to a cross-site request forgery vulnerability. CWE is classifying the issue as CWE-352. The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. This is going to have an impact on integrity. The summary by CVE is:

OpenClaude is an open-source coding-agent command line interface for cloud and local model providers. Prior to version 0.5.1, the OpenClaude MCP authentication flow starts a temporary local HTTP server to handle OAuth callbacks. To prevent CSRF attacks, the server validates a state parameter against an internally stored value. However, due to a logic flaw in the order of conditionals, an attacker can completely bypass this check and force the server to shut down — without knowing the state value at all. This issue has been patched in version 0.5.1.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-42073 since 04/23/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

Upgrading to version 0.5.1 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 739b8d1f40fde0e401a5cbd2b9a55d88bd5124ad is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Gitlawb

Name

• openclaude

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5.0

License

• open-source

Website

• Product: https://github.com/Gitlawb/openclaude/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion