VulnerabilitiesSep 29, 2026

Official MCP Python SDK Flaw Can Let Malicious Servers Steal OAuth Credentials

MCP Python SDK flaw allows malicious servers to steal OAuth credentials.

A vulnerability in the official MCP Python SDK allows malicious MCP servers to trick applications into revealing OAuth credentials, including client secrets and authorization codes. The flaw, reported by Cycode, affects specific versions of the SDK when used with certain OAuth providers and can lead to the theft of access tokens with the application's granted permissions. Maintainers have released patches, but some configurations require additional steps for full mitigation.

AI summary of the linked source. Not reviewed by an editor. How this works

Read at source

Vendor Watch

Run Cycode?

Get an email when a new story names Cycode, usually within the hour.

Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch works Privacy

The lesson from this incident

Full lesson

A vulnerability in the official MCP Python SDK allowed malicious servers to manipulate OAuth flows, tricking client applications into leaking sensitive credentials such as client secrets and authorization codes. This represents a classic OAuth redirect/hijack class of flaw within a widely-used SDK, meaning any downstream application consuming the library inherited the vulnerability without necessarily knowing it. The risk is compounded because stolen OAuth tokens grant attackers the full permission scope of the compromised application, potentially enabling data exfiltration, account takeover, or lateral movement. This incident underscores the danger of trusting third-party SDKs without rigorous vetting and timely patching processes, especially in authentication-critical code paths.

What helps against this

How we list vendors

Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
For exampleHashiCorp Vault GitGuardian Secrets Detection Palo Alto Networks Idira Secrets Management all options
Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
For exampleQualys VMDR Axonius Exposures Rapid7 Exposure Command (InsightVM)all options
Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
For exampleGoogle Threat Intelligence Defused TF CrowdStrike Falcon Adversary Intelligence all options

Indicators of Compromise

Extracted by AI from the linked source. Not reviewed by an editor. How this works

mitre_attack — T1539

Entities

MCP Python SDK (product)OAuth (technology)Cycode (vendor)