Topic

Model Context Protocol

Coverage tagged model context protocol.

Articles: 1
Desk: 1

Data graphic: MCP server steals OAuth secrets. CVSS 7.5 High 6.5 for the interactive provider ; affected mcp 1.9.1–1.29.1 and 2.0.0–2.1.1, fixed in 1.30.0 / 2.2.0, M2M providers must also pass issuer=. An attack path runs from the MCP client to a malicious MCP server to the auth server it picked, which receives the client_secret and PKCE verifier.

highAI Security Model Context Protocol

Official MCP Python SDK Let Malicious Servers Steal OAuth Secrets, and Upgrading Isn't Enough

A flaw in the official MCP Python SDK let a hostile MCP server redirect OAuth client secrets. Fixed in 1.30.0 and 2.2.0, but M2M providers also need issuer=.

Oct 2 · 7 min