2026-09-28 · 2026-Q3
Official MCP Python SDK Let a Malicious MCP Server Redirect OAuth Client Secrets, Auth Codes, and PKCE Verifiers
Should this run hold this key at all?
- Fixable
- Vendor patch
- Vendor response
- Patched
- In the wild
- No
- Actor
- Attacker
Target
Applications built on the official `mcp` Python SDK that use OAuth with `OAuthClientProvider`, `ClientCredentialsOAuthProvider`, or `PrivateKeyJWTOAuthProvider`
Impact
The Model Context Protocol maintainers published GHSA-qx49-fqc8-xw99 (High, CVSS 7.5) on September 28, 2026. A malicious or compromised MCP server could make the SDK send `client_secret` values, authorization codes, PKCE verifiers, or signed assertions to an attacker-chosen token endpoint, enabling account takeover with whatever the application had been granted. Versions 1.9.1 through 1.29.1 and 2.0.0 through 2.1.1 are affected; 1.30.0 and 2.2.0 fix it, and unattended providers must also pass an explicit `issuer` parameter. Eight reporters are credited, including Cycode
Root cause
When modern authorization-server discovery returned 404, the SDK fell back to OAuth metadata served by the MCP server itself and never validated the issuer or bound stored credentials to the server they were issued for
Sources
Catalog
Cite this: AgentProv incident record: Official MCP Python SDK Let a Malicious MCP Server Redirect OAuth Client Secrets, Auth Codes, and PKCE Verifiers (2026-09-28). https://agentprov.com/incidents/2026-09-28-official-mcp-python-sdk-let-a-malicious-mcp-server-redirect-oauth-client
Related
- Also L1 · 2026-10-21LiteLLM 1.107.0 on PyPI and Docker Ships a Credential Stealer That Runs at Every Python StartupL1Credential
- Also L1 · 2026-10-17OpenCode Console Breach Exposes Users' Stored OpenAI, Anthropic, and Google API KeysL1Credential
- Also L1 · 2026-10-13IBM MCP Context Forge Shipped a Known JWT Secret, Letting Anyone Mint Platform Admin Tokens (CVE-2026-53709)L1Credential