utcp-http POSTs your client_secret to whatever token endpoint a remote OpenAPI spec names.

GHSA-8cp3-qxj6-px34 covers utcp-http <= 1.1.3, where OpenApiConverter._extract_auth() reads the OAuth2 tokenUrl straight out of a remote spec and never validates it. The ensure_secure_url() guard the library applies to discovery URLs and tool invocation URLs is simply absent on the token endpoint, so registering an attacker-controlled spec and invoking any generated OAuth2 tool exfiltrates client_id and client_secret (GitHub Advisory). Two companion advisories the same hour: redirect-following without re-validation, and a prior SSRF fix that was never applied to the GraphQL and WebSocket plugins.