MCP TypeScript SDK fixes vulnerability where OAuth client credentials could be stolen by a malicious MCP server
MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server
A GitHub security advisory disclosed that in affected versions of the MCP TypeScript SDK, the OAuth client lets the MCP server decide which authorization server credentials are sent to, and credentials are not bound to the authorization server they belong to. A malicious or compromised MCP server can specify its own authorization server, and the client, without user interaction, will send previously saved refresh_token and client_secret from prior logins, or client_secret or signed assertions from built-in provider configurations, to that server. Affected versions are @modelcontextprotocol/sdk 1.12.0 through 1.30.1, and some scenarios in @modelcontextprotocol/client 2.0.0 through 2.1.0; MCP servers built with the SDK and stdio clients are not affected. The advisory recommends that clients that may have connected to untrusted MCP servers rotate keys and revoke tokens, and if unable to upgrade, only connect to trusted servers.
The advisory lists the affected version ranges, the fixed versions, and three cases where the issuer still needs to be manually added after upgrading; teams using MCP OAuth clients can use this to troubleshoot.