MCP Python SDK Exposes OAuth Credential Redirect Vulnerability, Fixed in 1.30.0 and 2.2.0
The MCP Python SDK OAuth Flaw and the Cost of Implicit Trust
The official MCP Python SDK has a high-severity OAuth vulnerability (CVSS 7.5). A malicious MCP server can redirect the client's OAuth client secret, authorization code, and PKCE proof key to an attacker-controlled endpoint, thereby taking over the downstream identity provider session. The root cause is a missing issuer check in the legacy fallback discovery path: when the server returns HTTP 404 for the standard authorization server discovery request, the SDK directly requests OAuth configuration from that untrusted server and accepts it as-is.
The material fully reconstructs the OAuth credential redirection chain in the MCP Python SDK and the affected version range, allowing teams to check their own agent integrations.