2025-07 · 2025-Q3
mcp-remote Critical RCE
Layer tags: not yet tagged.
Target
mcp-remote (437K+ downloads)
Impact
Full system compromise via malicious MCP server OAuth flow
Root Cause
Improper handling of authorization_endpoint URL in OAuth flow
Layer tags: not yet tagged.