2026-09-28 · 2026-Q3
Official MCP Python SDK Let a Malicious MCP Server Redirect OAuth Client Secrets, Auth Codes, and PKCE Verifiers
PrimaryL1CredentialSecondaryL8Output / Destination
- Fixable:
- Yes, vendor patch
- Vendor response:
- Patched
- In the wild:
- No
- Actor:
- Attacker
Target
Applications built on the official `mcp` Python SDK that use OAuth with `OAuthClientProvider`, `ClientCredentialsOAuthProvider`, or `PrivateKeyJWTOAuthProvider`
Impact
The Model Context Protocol maintainers published GHSA-qx49-fqc8-xw99 (High, CVSS 7.5) on September 28, 2026. A malicious or compromised MCP server could make the SDK send `client_secret` values, authorization codes, PKCE verifiers, or signed assertions to an attacker-chosen token endpoint, enabling account takeover with whatever the application had been granted. Versions 1.9.1 through 1.29.1 and 2.0.0 through 2.1.1 are affected; 1.30.0 and 2.2.0 fix it, and unattended providers must also pass an explicit `issuer` parameter. Eight reporters are credited, including Cycode
Root Cause
When modern authorization-server discovery returned 404, the SDK fell back to OAuth metadata served by the MCP server itself and never validated the issuer or bound stored credentials to the server they were issued for