Vulnerability in the official Python SDK for MCP: a malicious server could steal OAuth keys and take over an agent's account
Prepared by Sintelligent with the help of SI. Publication time restored from the build log. . Updated: .
The more agents roam other people's servers, the more the "boring" places like OAuth issuer validation matter: agent security is built on protocols, not on model promises.
A flaw in the OAuth discovery logic: if a malicious MCP server returns 404 on the standard discovery address, the SDK takes its settings from the server itself and skips issuer validation, handing over client secrets, authorization codes and PKCE keys. The CVSS score is 7.5 for machine-to-machine providers and 6.5 for interactive ones; versions 1.9.1-1.29.1 and 2.0.0-2.1.1 are affected, with fixes in 1.30.0 and 2.2.0. According to The Hacker News, no exploitation has been recorded; users are advised to update, clear saved OAuth registrations and rotate secrets if necessary.