Reported by 4 outlets
MCP Python SDK OAuth Flaw Lets Malicious Servers Steal Credentials and Take Over Accounts
Why this score
- Breadth
- 2.00 / 2.0 · 4 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.59 / 0.6 · time to second source
- Recency
- × 0.18 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.9 / 10 = base × recency + community
Desk analysis
The vulnerability is in Anthropic's official MCP Python SDK: vulnerable releases 1.9.1 through 2.1.1 fail to validate the authorization server issuer during OAuth discovery for HTTP transport clients. A malicious MCP server can return a 404 during modern discovery, forcing an unsafe fallback that accepts attacker-controlled OAuth metadata specifying an attacker token endpoint. Client secrets, authorization codes, and PKCE proof keys are then redirected to the attacker, enabling account takeover against identity providers such as Okta, Google, and Microsoft Entra ID. The events carry no CVE assignment and list affected SDK versions explicitly.
This is not a generic SDK bug: the deception relies on the victim still seeing a legitimate identity provider login page while the authorization code is silently redirected to an attacker-controlled endpoint. The three news sources (cyberpress.org, gbhackers.com, thehackernews.com) and the Mastodon update all reference the same Cycode disclosure, with the update specifying version 1.30.0+ as the patched release. Because HTTP-based MCP clients connect to arbitrary servers, the exposure is broad for any deployment that uses vulnerable SDK releases and relies on OAuth providers without issuer validation; the score of 5.1 reflects limited but credible pickup.
Defenders should upgrade to SDK version 1.30.0 or later, the exact remediation mentioned in the Mastodon update. For environments that cannot patch immediately, restrict HTTP transport MCP clients to known, trusted server endpoints and audit network connections for unexpected token endpoint traffic. Hunt for evidence of compromise by reviewing OAuth authorization flows that reference unexpected token endpoints; check SDK logs for 404 responses during authorization-server discovery followed by fallback configurations, and inspect for attacker-controlled endpoints in OAuth metadata returned by MCP servers.
Watch for a vendor advisory from Anthropic assigning a CVE and for any exploitation telemetry showing malicious MCP servers actively returning forged 404 discovery responses. A second development to monitor is whether patched releases beyond 1.30.0 address additional discovery-path weaknesses not covered in the current disclosure.
Timeline
-
original reporting
MCP Python SDK OAuth Flaw Lets Malicious Servers Steal Credentials and Take Over Accounts
cyberpress.org · 14d ago · September 29th, 2026
A newly disclosed high-severity OAuth vulnerability in Anthropic’s official Model Context Protocol (MCP) Python SDK could allow a malicious MCP server to steal authentication material and take over user accounts. The flaw affects HTTP-based MCP clients using vulnerable SDK releases and OAuth providers, enabling attackers to obtain client secrets, authorization codes, and PKCE proof keys. The issue stems from a weakness in the SDK’s OAuth discovery logic. When an MCP client connects to a server requiring authentication, it must discover the legitimate authorization server and validate its identity before sending sensitive OAuth data. MCP Python SDK OAuth Flaw In vulnerable versions, an attacker-controlled MCP server can intentionally return a 404 response during modern authorization-server discovery, forcing the SDK into an unsafe fallback path. On that path, the SDK accepts OAuth configuration supplied directly by the MCP server without validating the authorization server’s issuer. The attacker can provide metadata that claims to belong to a legitimate identity provider, such as Okta, Google, or Microsoft Entra ID , while specifying an attacker-controlled token endpoint. The attack is particularly deceptive because the victim can still be shown a real login page hosted by the legitimate identity provider. After the user authenticates, the SDK receives a valid authorization code. However, instead of sending that code to the legitimate provider’s token endpoint, the vulnerable
-
update from gbhackers.com
Anthropic MCP Python SDK Flaw Enables OAuth Credential Theft and Account Takeover
gbhackers.com · 14d ago · September 29th, 2026
Research from Cycode […] The post Anthropic MCP Python SDK Flaw Enables OAuth Credential Theft and Account Takeover appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from thehackernews.com
Malicious MCP servers can trick apps using the MCP Python SDK into revealing OAuth credentials. Update to version 1.30.0+ for security. # Cy
thehackernews.com · 10d ago · October 3rd, 2026
Malicious MCP servers can trick apps using the MCP Python SDK into revealing OAuth credentials. Update to version 1.30.0+ for security. # Cy
via Mastodon https://thehackernews.com/2026/09/official-mcp-python-sdk-flaw-can-let.html
-
update from cycode.com
An auth check that only runs on the happy path is not a check. In the MCP Python SDK, a malicious server answers OAuth discovery with a 404,
cycode.com · 2d ago · October 11th, 2026
An auth check that only runs on the happy path is not a check.