Official MCP Python SDK: a malicious MCP server could make an OAuth client send its client secret, auth code and PKCE verifier to the attacker (fixed in 1.30.0 / 2.2.0)
- Affected: apps using the SDK as an HTTP MCP client with OAuthClientProvider, ClientCredentialsOAuthProvider, PrivateKeyJWTOAuthProvider or the deprecated 1.x RFC7523OAuthClientProvider, that may connect to an MCP server you don't fully trust while holding credentials for a real authorization server. MCP servers built with the SDK, stdio clients, and clients that attach their own tokens are not affected.
- Fix: upgrade to
mcp1.30.0 or 2.2.0+. For ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider, upgrading does nothing until you also passissuer=(on 1.30.0 the missing-issuer warning is a hidden DeprecationWarning). Move off RFC7523OAuthClientProvider, which has no issuer option. - After upgrading: clear stored OAuth client registrations once so they re-register with an issuer binding; if a client may have talked to an untrusted MCP server, rotate its client secret and revoke its tokens.
Sources: GitHub advisory GHSA-qx49-fqc8-xw99 (modelcontextprotocol/python-sdk, Sep 28) · Cycode: MCP Python SDK OAuth account takeover