Neutron, our AI engine, scored 97.1% on UC Berkeley's CyberGym benchmark. Learn more

Tag

#oauth

1 articles

Deep Dive

OpenCode MCP OAuth Sign-In RCE on Windows, Fixed in 1.18.33

In OpenCode 1.0.137 to 1.18.32 on Windows and WSL, a malicious MCP server's OAuth sign-in URL reaches PowerShell and runs code as the developer; fixed in 1.18.33, with no CVE.

Ostorlab Team
Oct 26, 2026