CVE-2026-77272: MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler

The OAuth 2.0 setup wizard’s local callback HTTP server reflects the error query parameter directly into an HTML response without any sanitization or encoding. An attacker can craft a malicious callback URL containing JavaScript in the error parameter that executes in the victim’s browser when the setup wizard is running. The server binds to all network interfaces (0.0.0.0), making it accessible from the local network rather than just localhost.