2026-10-06 · 2026-Q4
MCP TypeScript SDK: A Malicious MCP Server Could Name Its Own Authorization Server and Receive Stored OAuth Credentials (CVE-2026-104850)
PrimaryL1CredentialSecondaryL8Output / Destination
- Fixable:
- Yes, vendor patch
- Vendor response:
- Patched
- In the wild:
- No
- Actor:
- Attacker
Target
`@modelcontextprotocol/sdk` 1.12.0 to before 1.31.0 and `@modelcontextprotocol/client` 2.0.0 to before 2.2.0
Impact
The TypeScript counterpart of the September 28 Python SDK flaw. A malicious MCP server could point the client at an authorization server it controls and receive refresh tokens or client secrets from earlier sign-ins, or signed assertions from the bundled `ClientCredentials`, `PrivateKeyJwt`, and `CrossAppAccess` providers, with no user interaction. Fixed in 1.31.0 and 2.2.0. Seven reporters credited
Root Cause
Stored credentials were not bound to the authorization server that issued them