Infrastructure & Security

Infrastructure & Security · Oct 3, 2026

Official MCP Python SDK flaw (CVSS 7.5) lets a malicious server steal OAuth credentials, even though the login screen is real

A flaw in the OAuth client support of the official MCP Python SDK let the MCP server a client connected to decide where the client's credentials were sent (CVSS 7.5). Users approve on the genuine login page, so they cannot spot the attack. Defending against it requires validating the issuer and binding credentials to the authorization server that issued them.