ha-mcp OAuth 2.1 DCR mode enables network reconnaissance via an error oracle

Vulnerability

Overview

In ha-mcp versions prior to 7.0.0, the OAuth consent form (a beta feature) accepts a privileged user would only encounter during setup) accepts a user-supplied ha_url and makes a server-side HTTP request to {ha_url}/api/config with no validation [2][3]. An unauthenticated attacker can submit arbitrary URLs and, by observing distinct error messages, perform internal network reconnaissance. For example, a ConnectError indicates a host is down, while HTTP 401 suggests the service is alive but requires authentication [3]. This primitive also affects two additional code paths: REST tool calls using forged (unsigned tokens, and WebSocket connections [2][3].

Exploitation

Method

The attacker can drive the flow programmatically: register a client via open Dynamic Client Registration (DCR), extract a transaction ID, and submit arbitrary ha_url values without user interaction [3]. No authentication is needed. The error oracle reveals connectivity status, port state, and HTTP response codes of internal services [3]. For REST tool calls, the attacker must forge an accessoken (a simple base64-encoded JSON payload with ha_url and ha_token fields), which is feasible since tokens are not signed [3]. WebSocket code paths also accept the forged token to probe internal endpoints [2][3].

Impact

An attacker can scan internal networks, identifying live hosts, open ports, running services, and their authentication status [2][3]. This reconnaissance can be the first step in a broader breach, although data exfiltration is limited because most endpoints return JSON only for Home Assistant API paths [3]. The primary deployment method (using a pre-configured token) is not affected [2].

Mitigation

The vulnerability is fixed in version 7.0.0 [1][2]. Users should upgrade immediately upgrade ha-mcp-server to the latest version. There is no workaround for the OAuth beta feature is disabled by default and should not be enabled on vulnerable versions [1].