A high-severity security vulnerability in the official Model Context Protocol (MCP) Python SDK could allow malicious MCP servers to steal OAuth credentials from artificial intelligence applications. Tracked as GHSA-qx49-fqc8-xw99, the flaw has a CVSS score of 7.5 and affects HTTP-based MCP clients that use OAuth authentication while connecting to servers that are not fully trusted. The issue does not affect local studio clients, MCP servers, or applications that provide their own authentication tokens and headers.
The vulnerability is linked to the SDK’s OAuth discovery process. During authentication, an MCP client asks a server to identify the authorization server responsible for issuing tokens. A malicious server could return a 404 response for the standard OAuth discovery endpoint, forcing the SDK to use a fallback method. On this unsafe path, the SDK failed to properly validate the authorization server’s issuer, allowing the attacker to redirect the authentication flow to an infrastructure controlled by them.
As a result, attackers could capture an OAuth client secret, authorization code and PKCE proof key. These credentials may enable the attacker to obtain valid access tokens from the legitimate identity provider, potentially gaining the same permissions as the affected application. Depending on the configured OAuth scopes, the impact could include access to cloud services, internal APIs, databases, deployment systems and other connected resources. Long-lived client secrets and refresh tokens could also support continued access or account takeover.
The affected releases include MCP Python SDK versions 1.9.1 through 1.29.1 and versions 2.0.0 through 2.1.1. The maintainers fixed the issue in version 1.30.0 for the 1.x branch and version 2.2.0 for the 2.x branch. However, upgrading alone may not be sufficient for deployments using ClientCredentialsOAuthProvider or PrivateKeyJWTOAuthProvider; developers must explicitly configure the expected issuer= value. Users of the deprecated 1.x RFC7523OAuthClientProvider should migrate to another supported provider.
Organizations should immediately identify affected clients, upgrade the SDK and remove stored OAuth client registrations created by older releases. If a vulnerable client connected to an untrusted MCP server, administrators should rotate client secrets, revoke potentially exposed tokens and review authentication logs for suspicious activity. Teams unable to upgrade should restrict connections to MCP servers they completely control and trust. The advisory highlights the security risks created when AI agents connect external tools to privileged enterprise systems, making strict server verification and issuer validation essential safeguards.