Repository navigation
All MCP oauth flow return potential CSRF attack #9510
Description
Hey been running in a few issues trying to use MCP. And can't spot what I might've done wrong.
I also tried with stripe mcp and got the same results.
Note: I tested this on two independent machines
Description
{
"$schema": "https://opencode.ai/config.json",
"autoupdate": true,
"mcp": {
"notion": {
"type": "remote",
"url": "https://mcp.notion.com/mcp",
"enabled": true
}
}
}Plugins
n/a
OpenCode version
1.1.25
Steps to reproduce
opencode --version
1.1.25
opencode mcp auth notion
┌ MCP OAuth Authentication
│
◐ Starting OAuth flow..See video for additional context
Clipboard-20260119-212610-630.mp4
Screenshot and/or share link
No response
Operating System
26.0.1
Terminal
vscode
Activity
github-actions commentedon Jan 19, 2026
This issue might be a duplicate of existing issues. Please check:
Feel free to ignore if none of these address your specific case.
[-]MCP oauth flow returns potential CSRF attack[/-][+]All MCP oauth flow return potential CSRF attack[/+]danieluhm2004 commentedon Jan 19, 2026
Same here.
I checked this.
If even one Opencode client is enabled, OAuth authentication is performed on that server. It seems the state value isn't shared between processes, resulting in a rejection.
I killed all Opencode clients and tried logging in again, and it worked without any issues.
raserma commentedon Jan 20, 2026
Thank you, that solved the issue for me 🎉
github-actions commentedon Mar 26, 2026
To stay organized issues are automatically closed after 90 days of no activity. If the issue is still relevant please open a new one.