---
title: Official MCP Python SDK: a malicious MCP server could make an OAuth client send its client secret, auth code and PKCE verifier to the attacker (fixed in 1.30.0 / 2.2.0) | ctxsec
url: https://ctxsec.com/items/mcp-python-sdk-oauth-issuer-credential-redirect-ghsa-qx49
description: "The SDK's OAuth client support (mcp.client.auth) did not validate the authorization server's issuer on every discovery path and did not bind stored credentials to their authorization server, so a malicious or compromised MCP server could steer the client's client_secret, authorization code and PKCE code_verifier (or a signed JWT assertion) to a token endpoint it chose. Cycode, which found it, says the user only sees the real login page and then an apparently flaky server. Rated High; affects 1.9.1 to 1.29.1 and 2.0.0 to 2.1.1."
status: "official (GitHub advisory GHSA-qx49-fqc8-xw99, published Sep 28, 2026; Cycode research); fixed in mcp 1.30.0 / 2.2.0. Late coverage: re-surfaced on X Nov 7."
published: 2026-11-07
---

> The SDK's OAuth client support (mcp.client.auth) did not validate the authorization server's issuer on every discovery path and did not bind stored credentials to their authorization server, so a malicious or compromised MCP server could steer the client's client_secret, authorization code and PKCE code_verifier (or a signed JWT assertion) to a token endpoint it chose. Cycode, which found it, says the user only sees the real login page and then an apparently flaky server. Rated High; affects 1.9.1 to 1.29.1 and 2.0.0 to 2.1.1.

[← Context & Harness Attacks](/context) · [markdown](/items/mcp-python-sdk-oauth-issuer-credential-redirect-ghsa-qx49.md)

official (GitHub advisory GHSA-qx49-fqc8-xw99, published Sep 28, 2026; Cycode research); fixed in mcp 1.30.0 / 2.2.0. Late coverage: re-surfaced on X Nov 7.

2026-11-07

### Official MCP Python SDK: a malicious MCP server could make an OAuth client send its client secret, auth code and PKCE verifier to the attacker (fixed in 1.30.0 / 2.2.0)

- **Affected:** apps using the SDK as an HTTP MCP client with OAuthClientProvider, ClientCredentialsOAuthProvider, PrivateKeyJWTOAuthProvider or the deprecated 1.x RFC7523OAuthClientProvider, that may connect to an MCP server you don't fully trust while holding credentials for a real authorization server. MCP servers built with the SDK, stdio clients, and clients that attach their own tokens are not affected.
- **Fix:** upgrade to `mcp` 1.30.0 or 2.2.0+. For ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider, upgrading does nothing until you also pass `issuer=` (on 1.30.0 the missing-issuer warning is a hidden DeprecationWarning). Move off RFC7523OAuthClientProvider, which has no issuer option.
- **After upgrading:** clear stored OAuth client registrations once so they re-register with an issuer binding; if a client may have talked to an untrusted MCP server, rotate its client secret and revoke its tokens.

Sources: [GitHub advisory GHSA-qx49-fqc8-xw99 (modelcontextprotocol/python-sdk, Sep 28)](https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-qx49-fqc8-xw99) · [Cycode: MCP Python SDK OAuth account takeover](https://cycode.com/blog/mcp-python-sdk-oauth-account-takeover/)