MCP SDK Vulnerability Lets Malicious Servers Steal OAuth Credentials

A security advisory released by the maintainers of the official MCP Python SDK revealed a serious vulnerability that could allow malicious servers to intercept OAuth credentials during authentication flows. The issue stems from how the SDK constructs token requests; affected versions send the client secret, the authorization code, and the PKCE proof key directly to a token endpoint controlled by an attacker. This behavior effectively hands over all sensitive information needed to complete the OAuth flow, enabling attackers to obtain valid access tokens without any user interaction. The fix is available in version 1.30.0 and later releases, which enforce proper validation before forwarding requests to external services. ¹

The problem arises when applications built on the vulnerable SDK communicate with identity providers such as Microsoft Azure AD or other OAuth‑based systems. Because the SDK does not verify whether the token endpoint belongs to the legitimate provider, it blindly forwards credentials to whatever URL the application points to. An attacker who controls a server can therefore pose as a legitimate token issuer and capture every piece of data sent by the client, including the client secret that should remain confidential. Even if the target service uses only local accounts, the flaw remains exploitable whenever the SDK is integrated into larger cross‑application workflows that rely on OAuth for data sharing. Users are urged to update immediately to at least 1.30.0 to mitigate this risk. ¹

Security experts note that the root cause lies in improper parameter validation within the `msal` (Microsoft Authentication Library) functions called by MCP. Similar logic flaws were previously reported under CVE‑2023–29676 in May, where attackers could gain unauthorized access through Azure AD Connect Sync agents. Microsoft patched that issue after public disclosure via Twitter/X. The new MCP vulnerability mirrors those earlier incidents: authentication checks were delegated too eagerly without strict verification of the intended token endpoint. This oversight allows man‑in‑the‑middle attacks that redirect user flows to malicious servers without triggering typical security alerts. Developers are encouraged to adopt robust static analysis tooling during build processes and enforce continuous monitoring to detect such deviations early. Continuous vigilance is essential because many modern applications depend on third‑party libraries; any lapse in dependency management can expose sensitive credentials across entire ecosystems.

The advisory underscores a broader trend: as identity services become more ubiquitous, vulnerabilities in client libraries pose widespread risks. Even seemingly minor oversights—like failing to validate a URL—can lead to credential theft with potentially catastrophic consequences for enterprises and consumers alike. By promptly applying the available patch and reviewing integration points, organizations can protect OAuth secrets from being redirected to attacker‑controlled endpoints, preserving both privacy and system integrity.