GHSA-rwqj-c54w-32jr: 
Python Analyse et atténuation de la vulnérabilité

Summary

Two log statements write OAuth-sensitive material at INFO/ERROR level:

• oauth_setup.py: logger.info(f"Opening browser for authorization at {auth_url}") — the authorization URL contains client_id, scope, redirect_uri, and the CSRF state.
• oauth.py: on token-exchange failure and JSON-parse failure, response.text from the token endpoint is logged (f"...Response: {response.text}"). A token-endpoint body can contain tokens or error detail depending on the failure mode.

Impact

Anyone with read access to the logs (other local users, log aggregation, support bundles) obtains OAuth flow parameters and potentially token-endpoint response bodies. The state in logs weakens CSRF protection if logs are exposed; response.text may leak sensitive material on partial failures.

Proof of concept

poc/verify_log_leaks.py confirms both log statements are present.

Remediation

• Log the authorization endpoint without the query string (or redact state/code_challenge).
• Never log raw token-endpoint response bodies; log status code + a generic message, and redact any token-shaped fields.

Fix

Fixed in mcp-atlassian 0.24.1.