The official Model Context Protocol (MCP) Python SDK contained a flaw where a malicious MCP server could trick a client application into sending its OAuth client secret, authorization code, and PKCE proof key to an attacker-controlled token endpoint. The maintainers disclosed the issue in a security advisory and released fixed versions starting at 1.30.0.
Disclosed 29 September 2026 · Record updated 1 October 2026
A malicious MCP server could obtain OAuth client secrets, authorization codes, and PKCE proof keys from applications built on affected versions of the SDK, potentially allowing attackers to impersonate the client and access the real service on the victim's behalf.
VulnerabilitiesMaintainers of the official Model Context Protocol Python SDK have patched a flaw that sent client secrets and authorisation codes to attacker-controlled endpoints.
29 Sept 2026
