CVE Intelligence

Punkpeye vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Punkpeye products: 1 record(s), with severity, exploitation and fixes.

Mcp-remote 1

Exploited only (KEV) →

CVE-2026-108716 Medium · 5.3 CWE-319 Oct 11, 2026
mcp-remote 0.8.0 through 0.14.3 Cleartext Credential Transmission via --device-code OAuth Grant
mcp-remote 0.8.0 through 0.14.3 contains a cleartext transmission vulnerability in authorizeWithDeviceCode that sends client secrets and receives tokens without enforcing HTTPS endpoints. When discovered device authorization and token endpoints are non-loopback http URLs, on-path network attackers can capture the client secret plus issued access and refresh tokens.