GHSA-4997-47j2-9w2q: 
JavaScript vulnerability analysis and mitigation

Summary

The hosted server proxies GitHub sign-in through one fixed GitHub app and accepted dynamic registration of any MCP client and redirect URI, without asking the user to approve the client. For a user who had already authorised teamctx on GitHub, GitHub skips its own prompt, so a crafted authorize link could send an authorisation code to an attacker-controlled redirect.

Impact

The attacker redeems the code for a long-lived refresh token (90 days) carrying the victim's GitHub access. With it they can read private .teamctx content, commit as the victim, and, on projects the victim manages, send a collaborator invite with admin permission.

Preconditions

• The victim has previously authorised the teamctx GitHub app.
• The victim opens an attacker-supplied link. No further click if Google sign-in is off; one click on the real teamctx domain if it is on.

Affected code

• src/oauth/provider.js: client registration; authorize() went straight to GitHub; code exchange ignored resource.
• api/mcp/[owner]/[repo].js: owner and repo come from the URL and were authorised by the token's GitHub access.

Patches

Fixed in 0.5.2.

• A consent page names the client and where the result is sent (scheme and host) and requires Approve before any code is issued. Approval is remembered per user, client and redirect target.
• A sign-in can only be finished in the browser that started it (a short-lived HttpOnly cookie, checked in the GitHub and Google callbacks).
• Dynamic client registration validates redirect URIs (https, loopback http, or a private-use scheme for desktop apps), bounds the client name, and is rate limited.
• Access and refresh tokens are stored by their hash, bound to the project they were issued for, and rotated with replay detection: reuse of a refresh token revokes the whole sign-in.
• A repository invite sent through the hosted server is capped at push.
• The OAuth endpoints send security headers. Everyone signs in to their assistant again once after upgrading, because tokens are now stored by hash.

Workarounds

Short of upgrading, revoke the teamctx GitHub app authorisation. Operators can disable dynamic client registration if the deployment allows it.

Credits

Found in an internal security review.