OpenClaude's authentication flow starts a temporary local HTTP server to handle OAuth callbacks. A logic flaw in the order of conditionals allows an attacker to bypass the CSRF state check by sending an error parameter, causing the server to shut down without needing the correct state value. This results in a denial of service, interrupting authentication and any processes that depend on the OpenClaude server. The flaw corresponds to CWE‑352 for the bypassed CSRF check and CWE‑400 for the resulting denial of service.

Anywhere OpenClaude GPLed before version 0.5.1 is affected, including the open‑source command line interface provided by Gitlawb:openclaude. The vulnerability exists in all releases prior to 0.5.1 and can impact any user who uses the default local HTTP callback server during OAuth authentication.

The CVSS score of 6.5 indicates moderate severity. Because the exploit requires access to the local OAuth callback endpoint, it is most likely a local or network attacker with reach to the OpenClaude process. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting current exploitation activity may be limited. However, the simple request needed to trigger the shutdown makes the attack trivial for an adversary who can reach the callback. As soon as a DoS occurs, the OpenClaude service stops handling requests until it is manually restarted or the process is relaunched.