How AI contributed: Direct introductionPublished Mar 12, 2026 in 
homeassistant-ai/ha-mcpAll 4 findings in this repository
OAuth mode is a beta feature of ha-mcp that needs MCP_BASE_URL and serves the consent endpoint on every interface, so anyone who can reach it can register a dynamic client without an initial access token. The consent form shown to the operator was built from Python f-strings: the application name was printed as markup, the client id, redirect URI and state were printed inside hidden input value attributes, and the error pages printed the error code and description, all without escaping. A registered application name carrying markup therefore executed in the operator's browser, and an injected quote could add attributes or tags of the attacker's choosing. Exploitation needs the operator to open a crafted authorization link for an application they do not recognize, and the prize is the Home Assistant access token entered on that page. Release 7.0.0 escapes every interpolated value and displays the redirect domain instead of the application name.
The consent page was assembled from f-strings and none of the interpolated values were escaped, so the registered application name appeared as markup and the client id, redirect URI and state sat inside hidden field value attributes, where a double quote ends the attribute and lets an attacker add further markup. The error views printed the OAuth error code and description the same way. Client registration is open by design, so an attacker registers an application whose fields carry the payload and sends the operator the authorization link; script running on that page reads the Home Assistant long-lived access token the operator types in and sends it to the attacker. The remedy escapes every interpolated value and stops displaying the application name.
Root cause
The consent form entered the codebase with f-string HTML that interpolated the registered application name, the client id, redirect URI, state and the error text without escaping any of them, which made those attacker-controlled strings markup in the operator's browser.
Fix
Every interpolated value now passes through html.escape into a local named safe before it reaches the page, and the application name is no longer displayed at all, which removes the injection points instead of filtering particular characters.
Case facts
ChatGPT/Codex@@ -0,0 +294,26 @@ def create_consent_html(+ <div class="client-info">+ <p>Application: <strong>{display_name}</strong></p>+ </div>++ {error_html}++ <form method="POST" id="consent-form">+ <input type="hidden" name="client_id" value="{client_id}">+ <input type="hidden" name="redirect_uri" value="{redirect_uri}">+ <input type="hidden" name="state" value="{state}">++ <div class="form-group">+ <label for="ha_url">Home Assistant URL</label>@@ -38,7 +47,13 @@ def create_consent_html( domain = _extract_domain(redirect_uri)+ safe_domain = html.escape(domain)+ safe_client_id = html.escape(client_id)+ safe_redirect_uri = html.escape(redirect_uri)+ safe_state = html.escape(state)+ safe_txn_id = html.escape(txn_id) error_html = "" if error_message:+ safe_error = html.escape(error_message) error_html = f"""@@ -310,3 +319,3 @@ def create_consent_html(- <input type="hidden" name="client_id" value="{client_id}">- <input type="hidden" name="redirect_uri" value="{redirect_uri}">- <input type="hidden" name="state" value="{state}">+ <input type="hidden" name="client_id" value="{safe_client_id}">+ <input type="hidden" name="redirect_uri" value="{safe_redirect_uri}">+ <input type="hidden" name="state" value="{safe_state}">AI-assisted change 4b2b2ef5200d0555b6c41a7c5625e0ec1712f49881c48e74f9a67908c643777c · Fix 0cf15158113cb108c1cbcb19ca1f3f7dd34788896adec31994d1bb1b8ad9c2d4