Official MCP Python SDK flaw lets malicious servers steal client OAuth credentials

The maintainers of the official Model Context Protocol Python SDK disclosed a flaw that lets a malicious MCP server trick an application built on the SDK into handing over the OAuth credentials it uses to log in to a real service. Affected versions sent the client secret, authorization code, and PKCE proof key to an attacker-controlled token endpoint, because the SDK did not always verify where the authorization server was. Cycode, which reported it, exchanged the stolen material for a valid access token carrying the app's permissions, and noted the long-lived client secret keeps working until rotated. Fixes are in versions 1.30.0 and 2.2.0.

Check

Upgrade the MCP Python SDK to 1.30.0 or 2.2.0, then rotate any OAuth client secrets that MCP clients may have sent to untrusted servers.

Affected

Applications built on affected MCP Python SDK versions can be induced by a malicious MCP server to leak their OAuth client secret, authorization code, and PKCE key.

Fix

Update the SDK, rotate exposed client secrets, and connect MCP clients only to servers whose authorization endpoints you trust and validate.