2026-10-06 · 2026-Q4
MCP TypeScript SDK: A Malicious MCP Server Could Name Its Own Authorization Server and Receive Stored OAuth Credentials (CVE-2026-104850)
Should this run hold this key at all?
- Fixable
- Vendor patch
- Vendor response
- Patched
- In the wild
- No
- Actor
- Attacker
Target
`@modelcontextprotocol/sdk` 1.12.0 to before 1.31.0 and `@modelcontextprotocol/client` 2.0.0 to before 2.2.0
Impact
The TypeScript counterpart of the September 28 Python SDK flaw. A malicious MCP server could point the client at an authorization server it controls and receive refresh tokens or client secrets from earlier sign-ins, or signed assertions from the bundled `ClientCredentials`, `PrivateKeyJwt`, and `CrossAppAccess` providers, with no user interaction. Fixed in 1.31.0 and 2.2.0. Seven reporters credited
Root cause
Stored credentials were not bound to the authorization server that issued them
CVE
Sources
Catalog
Cite this: AgentProv incident record: MCP TypeScript SDK: A Malicious MCP Server Could Name Its Own Authorization Server and Receive Stored OAuth Credentials (CVE-2026-104850) (2026-10-06). https://agentprov.com/incidents/2026-10-06-mcp-typescript-sdk-a-malicious-mcp-server-could-name-its-own-authorization
Related
- Also L1 · 2026-10-21LiteLLM 1.107.0 on PyPI and Docker Ships a Credential Stealer That Runs at Every Python StartupL1Credential
- Also L1 · 2026-10-17OpenCode Console Breach Exposes Users' Stored OpenAI, Anthropic, and Google API KeysL1Credential
- Also L1 · 2026-10-13IBM MCP Context Forge Shipped a Known JWT Secret, Letting Anyone Mint Platform Admin Tokens (CVE-2026-53709)L1Credential