A security vulnerability discovered in the official Model Context Protocol Python SDK can allow malicious servers to trick client applications into surrendering sensitive OAuth credentials.
Vulnerability Mechanism
According to the SDK's maintainers and security firm Cycode, affected versions fail to properly verify the location of the authorization server when requested by an MCP client. This flaw allows an untrusted server to intercept client secrets, authorization codes, and PKCE proof keys by redirecting token transmission to an attacker-controlled endpoint. Cycode demonstrated that attackers can use these stolen credentials to obtain valid access tokens carrying the full permissions granted to the application. The issue is rated high with a CVSS score of 7.5 for providers operating without human intervention, and 6.5 for interactive providers.
Affected Configurations
Applications are vulnerable when utilizing the SDK as an HTTP-based MCP client with specific OAuth providers, including OAuthClientProvider, ClientCredentialsOAuthProvider, PrivateKeyJWTOAuthProvider, or the deprecated 1.x RFC7523OAuthClientProvider, while connecting to untrusted servers. Local stdio clients, MCP servers built with the SDK, and clients managing their own tokens remain unaffected. No CVE identifiers had been assigned by September 29.
Remediation and Mitigation
Developers must upgrade to version 1.30.0 on the 1.x line or version 2.2.0 on the 2.x line, where the client pre-determines the expected login service and rejects mismatched details. However, updating alone is insufficient for ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider implementations, which also require explicitly passing an issuer parameter to define the authorized login service. Additionally, administrators should clear stored OAuth client registrations, rotate long-lived client secrets, and revoke active tokens if previous exposure to untrusted servers is suspected.
AI-generated editorial illustration; not a documentary photograph.
Source: Official MCP Python SDK Flaw Can Let Malicious Servers Steal OAuth Credentials
SIGNAL TITANS
Leave a Reply