Official MCP Python SDK Flaw Can Let Malicious Servers Steal OAuth Credentials
Summary: The maintainers of the official MCP Python SDK said in a security advisory that affected versions did not always verify the authorization server named by an MCP server, so a malicious server could direct the client to send its client secret, authorization code, and PKCE proof key to an attacker-controlled token endpoint. The flaw is rated high (7.5) for the two providers that run without a person present and 6.5 for the interactive provider, is fixed in versions 1.30.0 and 2.2.0, and had no CVE assigned as of September 29.
What you should know: The client secret is long-lived and keeps working until it is changed, and Cycode demonstrated that the stolen credentials yield a valid access token carrying whatever permissions the app was granted. Upgrading alone is not enough for ClientCredentialsOAuthProvider or PrivateKeyJWTOAuthProvider users, who must also pass issuer= or the client still follows whichever server the MCP server points it at.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026