Onyx's GET /api/mcp/servers and /api/mcp/servers/persona/{persona_id} endpoints incorrectly copy per‑user OAuth Authorization headers into a shared admin MCPConnectionConfig row, which is then returned to any authenticated user with BASIC_ACCESS rights. This flaw allows one user to obtain another user’s OAuth token, enabling the attacker to impersonate or access third‑party services on the victim’s behalf. The vulnerability is classified under CWE‑200 (Information Exposure) and CWE‑863 (Improper Handling of Sensitive Information).

Versions of the Onyx open‑source AI platform prior to 3.1.10, 3.2.14, and 4.0.0 are affected. The onyx‑dot‑app:onyx product is impacted when deployed with any of these earlier releases. All users of the affected releases are potentially at risk.

The CVSS score of 9.6 indicates a critical severity. While the EPSS score is not available, the flaw is already listed in public advisories, and the attack can be carried out by any authenticated BASIC_ACCESS user who performs the vulnerable GET requests. Because the leaked OAuth header is usable by the attacker, the impact extends to confidentiality and integrity of the victim’s third‑party service access. The flaw is not yet shown as a known exploited vulnerability in the CISA KEV catalog.