MCP TypeScript SDK fixes redirect and OAuth credential flaws
Start here
The MCP reference SDKs published three security advisories in their respective repositories on October 2, 2026, fixing the HTTP client transport following redirects to arbitrary origins, and the TypeScript SDK's experimental task store not validating session ownership. Among them, the TypeScript redirect flaw GHSA-6prh-2h8m-c8cw is medium severity, CVSS 3.1 6.5, affecting @modelcontextprotocol/sdk up to 1.31.0. The subsequently released MCP TypeScript SDK 1.32.0 adds a redirect same-origin restriction: the HTTP client transport only follows redirects when same-origin (same scheme, host, and port, with http to https allowed for the same host); if the deployment endpoint redirects to another host or port, the final URL must be configured, or redirectPolicy: 'follow' must be set on StreamableHTTPClientTransport or SSEClientTransport. The GitHub security advisory also disclosed that in affected versions, the SDK's OAuth client lets the MCP server decide which authorization server credentials are sent to, and credentials are not bound to the authorization server they belong to; a malicious or compromised MCP server can specify its own authorization server, and the client, without user interaction, will send previously saved refresh_token and client_secret from prior logins, or the client_secret or signed assertion configured for built-in providers, to it.
Generated by AI from reports · Updated 4 days ago
Latest developments
Progress timeline
- GitHub 安全公告SelectedMCP TypeScript SDK fixes vulnerability where OAuth client credentials could be stolen by a malicious MCP server
A GitHub security advisory disclosed that in affected versions of the MCP TypeScript SDK, the OAuth client lets the MCP server decide which authorization server credentials are sent to, and credentials are not bound to the authorization server they belong to. A malicious or compromised MCP server can specify its own authorization server, and the client, without user interaction, will send previously saved refresh_token and client_secret from prior logins, or client_secret or signed assertions from built-in provider configurations, to that server. Affected versions are @modelcontextprotocol/sdk 1.12.0 through 1.30.1, and some scenarios in @modelcontextprotocol/client 2.0.0 through 2.1.0; MCP servers built with the SDK and stdio clients are not affected. The advisory recommends that clients that may have connected to untrusted MCP servers rotate keys and revoke tokens, and if unable to upgrade, only connect to trusted servers.
- MCP TypeScript SDKMCP TypeScript SDK 1.32.0 发布，新增重定向同源限制与工具调用参数上限
MCP TypeScript SDK 发布 1.32.0，HTTP 客户端传输现在只在同源（相同 scheme、host 和 port，同 host 的 http 到 https 允许）时跟随重定向；若部署端点重定向到其他 host 或 port，需配置最终 URL，或在 StreamableHTTPClientTransport、SSEClientTransport 上设置 redirectPolicy: 'follow'，浏览器中未设置该选项的重定向请求会失败。新增两个默认关闭的选项：McpServer 的 maxToolInputElements 限制工具调用参数中数组元素和对象成员的数量；requireBearerAuth 的 expectedResource 只接受为该服务器签发的 token（token 的 audience）。
- Date not givenal-ice.aiSelectedMCP SDK fixes cross-origin redirect and task session defects; three advisories did not enter CVE and OSV
Model Context Protocol 参考 SDK 于 2026 年 10 月 2 日在各自仓库发布三条安全公告，修复 HTTP 客户端传输跟随任意源重定向以及 TypeScript SDK 实验性任务存储未校验会话归属的问题。重定向缺陷中，TypeScript 侧 GHSA-6prh-2h8m-c8cw 为 medium、CVSS 3.1 6.5，影响 @modelcontextprotocol/sdk 至 1.31.0 与 @modelcontextprotocol/client 2.0.0 至 2.2.0，修复于 1.32.0 和 2.3.0；Python 侧 GHSA-5h93-6whr-6q8j 为 medium、CVSS 3.1 5.9，影响 mcp 1.8.0 至 1.29.1 和 2.0.0 至 2.1.1，修复于 1.30.0 和 2.2.0。
Related discussion
Attention trend
New sources per day
- Oct 3New1 sources (1 outlets,0 accounts)
- Oct 4New0 sources (0 outlets,0 accounts)
- Oct 5New1 sources (1 outlets,0 accounts)
- Oct 6New1 sources (1 outlets,0 accounts)
- Oct 7New0 sources (0 outlets,0 accounts)
- Oct 8New0 sources (0 outlets,0 accounts)
- Oct 9New0 sources (0 outlets,0 accounts)
- Oct 10New0 sources (0 outlets,0 accounts)
- Oct 11New0 sources (0 outlets,0 accounts)
- Oct 12New0 sources (0 outlets,0 accounts)
- Oct 13New0 sources (0 outlets,0 accounts)