MCP Python SDK OAuth vulnerability causes credential redirect
Start here
Cycode publicly disclosed Yuval Elbar's coordinated disclosure research on September 28, 2026, pointing out a full account takeover vulnerability in Anthropic's official MCP Python SDK: a malicious MCP server can hijack the SDK's OAuth login flow, obtain the victim's client secret, authorization code, and PKCE proof key, and then exchange them for valid access tokens at the real identity provider. Affected versions are mcp 1.9.1 through 1.29.1 and 2.0.0 through 2.1. The vulnerability is rated high severity (CVSS 7.5), with the root cause being a lack of issuer validation in the legacy fallback discovery path: when the server returns HTTP 404 for the standard authorization server discovery request, the SDK directly requests OAuth configuration from that untrusted server and accepts it as-is. Fixed versions 1.30.0 and 2.2.0 have been released. Since then, the MCP Python SDK released v2.3.0, primarily fixing issues and adding three configuration options: tools annotated with an invalid x-mcp-header now raise InvalidSignature at registration time, whereas previously the server would start normally but the client would silently drop the tool on 2026-07-28; empty _meta and params are no longer sent with requests, avoiding rejection by some servers; and a new max_sse_event_size option is added (default remains 1 MiB per SSE event).
Generated by AI from reports · Updated 4 days ago
Latest developments
- · 1 reportsMCP Python SDK releases v2.3.0
- · 2 reportsMCP Python SDK OAuth flaw causes credential redirection
Progress timeline
- MCP Python SDKMCP Python SDK v2.3.0 released: primarily fixes, three new configuration options
MCP Python SDK released v2.3.0, primarily fixes with three new options. Tools with invalid x-mcp-header annotations now raise InvalidSignature at registration time; previously the server would start normally but the 2026-07-28 client would silently drop the tool. Empty _meta and params are no longer sent with requests, avoiding rejection by some servers. Added max_sse_event_size option (default remains 1 MiB per SSE event), MCPServer(subscriptions=False) can stop offering subscriptions/listen, and Client.call_tool re-lists tools and retries once after HeaderMismatch (-32020).
- CSA Labs ResearchSelectedMCP Python SDK Exposes OAuth Credential Redirect Vulnerability, Fixed in 1.30.0 and 2.2.0
The official MCP Python SDK has a high-severity OAuth vulnerability (CVSS 7.5). A malicious MCP server can redirect the client's OAuth client secret, authorization code, and PKCE proof key to an attacker-controlled endpoint, thereby taking over the downstream identity provider session. The root cause is a missing issuer check in the legacy fallback discovery path: when the server returns HTTP 404 for the standard authorization server discovery request, the SDK directly requests OAuth configuration from that untrusted server and accepts it as-is.
- 网页The Hacker News· DiscussionOfficial MCP Python SDK Flaw Can Let Malicious Servers Steal OAuth Credentials(opens the original post in a new tab)
- Date not givenal-ice.aiSelectedCycode discloses Anthropic MCP Python SDK OAuth account takeover vulnerability; fixed versions released
Cycode publicly disclosed Yuval Elbar's coordinated disclosure research on September 28, 2026, pointing out a full account takeover vulnerability in Anthropic's official MCP Python SDK. A malicious MCP server can hijack the SDK's OAuth login flow, obtain the victim's client secret, authorization code, and PKCE proof key, and then exchange them for valid access tokens at the real identity provider. Affected versions are mcp 1.9.1 through 1.29.1 and 2.0.0 through 2.1.1; fixed versions 2.2.0 and 1.30.0 were released on September 7. The attack mechanism is that the server returns 404 to discovery requests, triggering a fallback path where the SDK does not obtain the authorization server URL, issuer validation is skipped, and credential binding and authorization code audience restrictions are based on the same unverified configuration, so all of them fail. Cycode verified with three test groups—attack, control, and escape—and only the attack configuration caused real credentials to leave the local machine.
Related discussion
- Older than 72 hours · Not included in the 72-hour figures
- 网页The Hacker NewsOfficial MCP Python SDK Flaw Can Let Malicious Servers Steal OAuth Credentials(opens the original post in a new tab)
Attention trend
New sources per day
- Sep 30New1 sources (1 outlets,0 accounts)
- Oct 1New0 sources (0 outlets,0 accounts)
- Oct 2New0 sources (0 outlets,0 accounts)
- Oct 3New1 sources (1 outlets,0 accounts)
- Oct 4New0 sources (0 outlets,0 accounts)
- Oct 5New1 sources (1 outlets,0 accounts)
- Oct 6New0 sources (0 outlets,0 accounts)
- Oct 7New0 sources (0 outlets,0 accounts)
- Oct 8New0 sources (0 outlets,0 accounts)
- Oct 9New0 sources (0 outlets,0 accounts)
- Oct 10New0 sources (0 outlets,0 accounts)
- Oct 11New0 sources (0 outlets,0 accounts)
- Oct 12New0 sources (0 outlets,0 accounts)
- Oct 13New0 sources (0 outlets,0 accounts)