LightNews — News, ranked by scholars

La vulnerabilidad OAuth en MCP que roba cuentas con un click

95,8% de servidores MCP aceptan cualquier redirect_uri. Así roban tu cuenta con un click y cómo Stream Vessel tapó el agujero en noviembre 2026

#mcp #oauth #seguridadinformática #phishing #modelcontextprotocol

La vulnerabilidad OAuth en MCP que roba cuentas con un click

Stream Vessel publicó un esquema de redirect URIs de confianza por usuario tras el caso Square y un estudio que halló fallas en 114 de 119 servidores MCP.

blog.donweb.com

November 5, 2026 at 1:28 AM

papoo7.bsky.social

@papoo7.bsky.social

Trusting redirect URIs without trusting the whole internet
https://papoo.work/doc/bd23be26697c1fff
#claudenews #anthropic #mcp #oauth #security

Trusting redirect URIs without trusting the whole internet

papoo.work

November 4, 2026 at 11:40 PM

Damien Bowden

@damienbod.com

Blogged: Use Open.IdentityServer for OpenID Connect in an Aspire setup

damienbod.com/2026/11/02/u...

#openid #openidconnect #oauth #aspire #aspnetcore #dotnet #oss

Use Open.IdentityServer for OpenID Connect in an Aspire setup

This article demonstrates how to build an OpenID Connect server using Open.IdentityServer (Rock Solid Knowledge) integrated with ASP.NET Core Identity to provide identity and access management (IAM…

damienbod.com

November 2, 2026 at 5:57 AM

Zyton.ai

@zyton.ai

A typical bearer token can be used by anyone who holds it. RFC 9449 (IETF, September 2023), DPoP, binds a token to a public key, and each request carries a proof signed with the matching private key. Not legal advice. #oauth #dpop

November 2, 2026 at 7:32 AM

papoo7.bsky.social

@papoo7.bsky.social

Trusting redirect URIs without trusting the whole internet
https://papoo.work/doc/bd23be26697c1fff
#claudenews #anthropic #mcp #oauth #security

Trusting redirect URIs without trusting the whole internet

papoo.work

November 6, 2026 at 3:21 PM

papoo7.bsky.social

@papoo7.bsky.social

Trusting redirect URIs without trusting the whole internet
https://papoo.work/doc/bd23be26697c1fff
#claudenews #anthropic #mcp #oauth #security

Trusting redirect URIs without trusting the whole internet

papoo.work

November 6, 2026 at 7:24 AM

papoo7.bsky.social

@papoo7.bsky.social

Trusting redirect URIs without trusting the whole internet
https://papoo.work/doc/bd23be26697c1fff
#claudenews #anthropic #mcp #oauth #security

Trusting redirect URIs without trusting the whole internet

papoo.work

November 6, 2026 at 4:22 AM

papoo7.bsky.social

@papoo7.bsky.social

Trusting redirect URIs without trusting the whole internet
https://papoo.work/doc/bd23be26697c1fff
#claudenews #anthropic #mcp #oauth #security

Trusting redirect URIs without trusting the whole internet

papoo.work

November 5, 2026 at 2:43 PM

papoo7.bsky.social

@papoo7.bsky.social

Trusting redirect URIs without trusting the whole internet
https://papoo.work/doc/bd23be26697c1fff
#claudenews #anthropic #mcp #oauth #security

Trusting redirect URIs without trusting the whole internet

papoo.work

November 5, 2026 at 11:48 AM

papoo7.bsky.social

@papoo7.bsky.social

Trusting redirect URIs without trusting the whole internet
https://papoo.work/doc/bd23be26697c1fff
#claudenews #anthropic #mcp #oauth #security

Trusting redirect URIs without trusting the whole internet

papoo.work

November 5, 2026 at 10:02 AM

papoo7.bsky.social

@papoo7.bsky.social

Trusting redirect URIs without trusting the whole internet
https://papoo.work/doc/bd23be26697c1fff
#claudenews #anthropic #mcp #oauth #security

Trusting redirect URIs without trusting the whole internet

papoo.work

November 5, 2026 at 8:46 AM

papoo7.bsky.social

@papoo7.bsky.social

Trusting redirect URIs without trusting the whole internet
https://papoo.work/doc/bd23be26697c1fff
#claudenews #anthropic #mcp #oauth #security

Trusting redirect URIs without trusting the whole internet

papoo.work

November 5, 2026 at 7:15 AM

azu

@azu.bsky.social

GitHub Appのインストールに管理者の承認が必要な場合のアカウント連携についてのDiscussion。
申請者と承認者が異なる場合に、`installation_id`を元の申請者と紐付けられない問題がある。 "How to make Github app connect after approval · community · Discussion #42351" https://github.com/orgs/community/discussions/42351 #GitHub #OAuth #discussion

November 5, 2026 at 2:29 AM

Duende Software

@duendesoftware.com

We built a Snake game where every pellet is an OAuth token exchange! Learn Duende IdentityServer's extension grants, profile service and token lifetimes.

duende.link/token-snake

#dotnet #oauth

OAuth Token Exchange in Practice: Building a Snake Game

Every pellet is a token exchange. See how TokenSnake uses Duende IdentityServer's custom extension grants, profile service and per-request token lifetimes, and how the same extensibility points apply…

duende.link

November 4, 2026 at 6:01 PM

Zyton.ai

@zyton.ai

RFC 7009 (IETF, August 2013) adds a revocation endpoint to OAuth 2.0: a client tells the authorization server a token is no longer needed, and the token is invalidated and cannot be used again. Not legal advice. #oauth #revocation

November 4, 2026 at 7:25 AM

Matthias Pfefferle

@pfefferle.org

404: specification not found

(Kleiner Nachtrag zu der "OAuth ist tot" Kolumne in der SCREENGUIDE Ausgabe 15 um zu zeigen, warum gerade das W3C auch für Community Formate durchaus nützlich sein kann) Vor ein...

https://notiz.blog/2012/09/20/404-specification-not-found/

404: specification not found

(Kleiner Nachtrag zu der "OAuth ist tot" Kolumne in der SCREENGUIDE Ausgabe 15 um zu zeigen, warum gerade das W3C auch für Community Formate durchaus nützlich sein kann) Vor ein paar Wochen kam eine E-Mail mit der Bitte, an einer Umfrage zu den W3C Community and Business Groups teilzunehmen und das hat mich daran erinnert,...

notiz.blog

April 15, 2026 at 12:55 PM