Prior to version 0.22.0 the MCP Atlassian OAuth error query parameter is inserted directly into an HTML page without escaping. A crafted authorization callback can inject markup or script that executes in the browser of a user completing the OAuth flow. This reflected XSS allows an attacker to run arbitrary client‑side code while a user authorises the application, potentially stealing session cookies or performing other malicious actions within the user’s session.

The vulnerability affects installations of the MCP Atlassian Model Context Protocol server used with Atlassian Confluence and Jira. Any version earlier than 0.22.0 contains the flaw, as the oauth_setup.py component handles OAuth callbacks without sanitising the error parameter.

The CVSS base score of 5.4 indicates a medium severity vulnerability. EPSS data is not available, so the current exploit likelihood is uncertain. The issue is not listed in the CISA KEV catalog, suggesting no confirmed exploitation yet. Attackers would need to craft a malicious OAuth redirect containing an error parameter with injected payload, which is reflected without escaping, enabling script execution. The impact is limited to the browser context of users completing the OAuth flow and does not compromise the server itself.