Model Context Protocol Python SDK flaw risks OAuth credential theft

A high-severity security flaw has been identified in the official Model Context Protocol (MCP) Python SDK, which could allow malicious servers to hijack OAuth credentials and take over user accounts. The vulnerability stems from the SDK’s failure to properly verify the identity of the authorization server during the login discovery process.

Security firm Cycode reported that affected versions of the SDK could be tricked into sending a client secret, an authorization code, and a Proof Key for Code Exchange (PKCE) verifier to an attacker-controlled endpoint. By obtaining these elements, an attacker can exchange them for valid access tokens from the legitimate login provider. Because the client secret is long-lived, an attacker can continue to mint new tokens with the application’s full permissions until the secret is rotated.

The flaw affects several provider types, including machine-to-machine and interactive providers. The vulnerability was assigned a CVSS score of 7.5 for machine-to-machine providers and 6.5 for interactive providers, where a user must initiate the sign-in. Affected versions include 1.9.1 through 1.29.1 and 2.0.0 through 2.1.1. Users are advised to upgrade to patched versions 1.30.0 or 2.2.0.