{"id":"CVE-2026-108716","summary":"mcp-remote 0.8.0 through 0.14.3 Cleartext Credential Transmission via --device-code OAuth Grant","details":"mcp-remote 0.8.0 through 0.14.3 contains a cleartext transmission vulnerability in authorizeWithDeviceCode that sends client secrets and receives tokens without enforcing HTTPS endpoints. When discovered device authorization and token endpoints are non-loopback http URLs, on-path network attackers can capture the client secret plus issued access and refresh tokens.","modified":"2026-10-14T02:30:42.704801492Z","published":"2026-10-11T12:19:28.640Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108716.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-319"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108716.json"},{"type":"ADVISORY","url":"https://hackmd.io/@haind03/punkpeye-mcp-remote-device-code-cleartext-oauth-transport"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108716"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/mcp-remote-0.8.0-through-0.14.3-cleartext-credential-transmission-via-device-code-oauth-grant"},{"type":"PACKAGE","url":"https://github.com/punkpeye/mcp-remote"},{"type":"ARTICLE","url":"https://github.com/punkpeye/mcp-remote/blob/v0.14.3/src/lib/client-credentials.ts#L37-L47"},{"type":"ARTICLE","url":"https://github.com/punkpeye/mcp-remote/blob/v0.14.3/src/lib/device-authorization.ts#L64-L170"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/punkpeye/mcp-remote","events":[{"introduced":"0496a12dc4fe7609565e8b268c85b6d4d6deb567"},{"fixed":"6a06aca546a8fd3b7beb040f39761b364893198d"}],"database_specific":{"source":["AFFECTED_FIELD","DESCRIPTION"],"extracted_events":[{"introduced":"0.8.0"},{"last_affected":"0.14.3"},{"fixed":"0.14.3"}]}}],"versions":["v0.14.2","v0.14.1","v0.14.0","v0.13.5","v0.13.4","v0.13.3","v0.13.2","v0.13.1","v0.13.0","v0.12.1","v0.12.0","v0.11.0","v0.10.0","v0.9.0","v0.8.7","v0.8.6","v0.8.5","v0.8.4","v0.8.3","v0.8.2","v0.8.1","v0.8.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108716.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}