MCP Python SDK Flaw Could Expose OAuth Credentials to Malicious Servers
Summary
A flaw in the MCP Python SDK could let malicious servers steal OAuth credentials and obtain valid access tokens. Upgrade to 1.30.0 or 2.2.0; some providers also require issuer configuration. No attacks have been reported.
Key points
- Affected SDK versions could send a client secret, authorization code, and PKCE proof key to an attacker-controlled token endpoint.
- An attacker could use the stolen credentials to obtain a valid access token with the application's permissions; the client secret remains usable until changed.
- The flaw affects HTTP MCP clients using specified OAuth providers when connecting to servers they do not fully control. SDK-built servers, local stdio clients, and clients attaching their own tokens are not affected.
- Upgrade 1.x clients to 1.30.0 or 2.x clients to 2.2.0.
- For ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider, configure issuer to identify the expected login service; the deprecated RFC7523OAuthClientProvider lacks this option.
- After upgrading, clear stored OAuth client registrations. If credentials may have been exposed, rotate the client secret and revoke tokens; no workaround exists for older versions beyond connecting only to trusted MCP servers.
- The advisory and reporter Cycode said they knew of no attacks exploiting the flaw.
Article Details
- Vulnerability Types
- OAuth credential disclosure through attacker-controlled token endpoint
- Authorization server issuer validation failure
- Severity
- High (7.5) for the two machine-to-machine providers; 6.5 for the interactive provider.
- Affected Versions
- MCP Python SDK 1.9.1 through 1.29.1
- MCP Python SDK 2.0.0 through 2.1.1
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- On older versions, connect only to MCP servers you trust.