Topic

Cve 2026 104850

Coverage tagged cve 2026 104850.

Articles: 1
Desk: 1

Data graphic: the MCP TypeScript SDK flaw CVE-2026-104850, CVSS 3.1 score 7.5 High, fixed in 1.31.0 and 2.2.0

highAI Security Cve 2026 104850

MCP TypeScript SDK Lets a Malicious Server Pull OAuth Secrets From Clients (CVE-2026-104850)

CVE-2026-104850 lets a malicious MCP server make the TypeScript SDK's OAuth client send refresh tokens and client secrets to an attacker's server. Fixed in 1.31.0 / 2.2.0.

Oct 6 · 4 min