AmoyLab Unla: Authentication bypass in OAuth2 authorization server
Summary
AmoyLab Unla, a self-hosted MCP gateway, does not authenticate the resource owner in its OAuth2 server. An unauthenticated attacker can register a client, obtain an authorization code via /authorize, exchange it at /token and receive valid access tokens. These tokens grant access to OAuth2-protected MCP routes, proxied upstream APIs and credentials injected by the gateway, provided the instance is reachable and uses OAuth2.
Affected
- AmoyLab Unla up to and including 0.10.0
- Relevant when OAuth2 is enabled and route prefixes are protected by OAuth2
Fixed in
- Unknown. OSV lists fixing commit 5da380b8d883165def1c0a19ec55025ef12db8a5, but no released version has been confirmed.
- No vendor advisory found.
Workaround
- Unknown. No vendor-confirmed mitigation.
- Place an authenticating proxy in front of /authorize, /token and the OAuth2-protected MCP prefixes (third-party recommendation).
- Restrict access to trusted networks or VPN.
Exploitation
- Not marked as known exploited; not listed in CISA KEV.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- Public write-up and VulnCheck advisory exist; no public exploit code or confirmed attacks found.
Our recommendation
- Inventory all Unla instances, including Docker images up to 0.10.0 and 'latest'.
- Check whether OAuth2 is enabled and which route prefixes use it.
- Restrict internet-facing instances to VPN or trusted networks, or place an authenticating proxy in front of them.
- Rotate upstream credentials on any instance that was reachable.
- Review logs for unexpected token issuance or access to protected routes.
- Apply a vendor release containing the fix once it is confirmed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- OSV: CVE-2026-108865 osv.dev
- VulnCheck advisory www.vulncheck.com
- Vendor repository: AmoyLab Unla github.com
- Unla oauth.go at v0.10.0 github.com
- Write-up: Unla OAuth self-issued token hackmd.io
- OpenCVE: CVE-2026-108865 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:34.
Original description (NVD)
AmoyLab Unla through 0.10.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid access tokens because the OAuth2 server never authenticates a resource owner. Attackers can register a client, request a code from /authorize, and exchange it at /token to access OAuth2-protected MCP prefixes, proxied upstream APIs and injected credentials.
NVD references (5)
- https://github.com/AmoyLab/Unla
- https://github.com/AmoyLab/Unla/blob/v0.10.0/internal/auth/oauth.go#L86-L147
- https://github.com/AmoyLab/Unla/blob/v0.10.0/internal/core/server.go#L229-L261
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/amoylab-unla-oauth-self-issued-token-authz
- https://www.vulncheck.com/advisories/amoylab-unla-through-0.10.0-oauth2-authentication-bypass-via-authorize
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.