MCP Python SDK Vulnerability: How Malicious Servers Can Steal OAuth Credentials

The official MCP (Model Context Protocol) Python SDK contained a security flaw that allowed a malicious MCP server to intercept and steal OAuth credentials from client applications. When a vulnerable application attempted to authenticate using OAuth, an attacker controlling a crafted MCP server could receive the client secret, authorization code, and PKCE proof key that the application was trying to use for legitimate authentication. This trio of secrets is enough for an attacker to impersonate the application and gain unauthorized access to the services it integrates with.

The vulnerability affects versions prior to 1.30.0. The SDK maintainers released a fix in version 1.30.0 and later, but many applications may still be running outdated code without realizing the risk.

OAuth flows typically involve redirecting users to an authorization server, receiving an authorization code, and then exchanging that code plus a client secret for access tokens. The PKCE (Proof Key for Code Exchange) mechanism adds extra security by having the client generate a proof key and verification key.

In the vulnerable versions, the MCP Python SDK did not properly validate where it should send these sensitive values. A malicious MCP server could intercept the client's token exchange request and redirect it to an attacker-controlled endpoint. The vulnerable SDK sent the client secret, authorization code, and PKCE proof key to this fake token endpoint without verification. Once the attacker has all three, they can complete the OAuth flow themselves and obtain valid access tokens that grant them the same permissions the legitimate application would have.

The attack is particularly effective because the application developer may not realize the MCP server is malicious. If the server is compromised, impersonated, or chosen from an untrusted source, the credentials leak silently during normal OAuth handshake operations.

Three key insights frame why this flaw represents a real risk to the ecosystem:

Credential handling in SDK code is a common blind spot. According to security-vendor incident reports and SDK audits, developers often assume that established libraries handle token exchange correctly and do not add additional validation. The MCP Python SDK is widely used in applications that integrate Claude AI and other services, meaning the blast radius for this flaw is broad. This matters because a single unpatched SDK version can expose credentials across hundreds of applications.

OAuth flows are high-value attack targets. Court records and law-enforcement press releases on credential theft show that attackers prioritize stealing OAuth tokens and client credentials because they bypass traditional password-based security and persist across sessions. A stolen client secret is nearly impossible for the application owner to detect without careful monitoring of unexpected API calls.

Malicious or compromised MCP servers are a realistic threat. Tor Project documentation and security research on federated protocols notes that when applications can load and trust external servers dynamically, the attack surface expands. An attacker need not compromise the official SDK repository; they only need to trick an application into connecting to a server they control.

Versions of the MCP Python SDK released before version 1.30.0 are vulnerable to this credential theft attack. Version 1.30.0 and all subsequent releases include the fix. The advisory was published on September 29, 2026.

To check which version your application uses:

1. Locate your project's requirements.txt, setup.py, or poetry.lock file.
2. Search for the line containing mcp or mcp-python-sdk.
3. Note the version number listed.
4. Compare it to 1.30.0. If the version is earlier, you are running vulnerable code.

If you do not know which version is installed in a running environment, you can check by running a quick diagnostic in Python: import the mcp module and check its __version__ attribute, or use your package manager's list command (pip list on systems using pip, poetry show on systems using Poetry).

The most direct step is to update the MCP Python SDK to version 1.30.0 or later. After updating, redeploy your application and restart any running instances. Old processes will continue to use the old vulnerable SDK until they are restarted.

Beyond the patch, implement these additional safeguards:

• Validate MCP server identity by checking digital signatures or certificates before connecting. Do not assume a server is trustworthy based on its hostname alone.
• Log all token exchange attempts and review logs for unexpected or failed exchanges. If a malicious server intercepts a request, log entries may show unusual patterns.
• Rotate OAuth credentials regularly even if no compromise is suspected. This limits the window of time an attacker can use stolen credentials.
• Monitor API usage for unexpected calls or activity spikes that might indicate stolen tokens are being used elsewhere.
• Use environment-isolated credentials for testing and development. Never use production OAuth client secrets in non-production environments.

The MCP Python SDK is designed to let applications communicate with MCP servers, which handle various tasks like code generation, data access, and AI model integration. OAuth credentials are often needed when those tasks require access to external services.

The vulnerability exists at the intersection of two trust layers: the application trusts the MCP SDK to handle credentials correctly, and the SDK trusts the MCP server to direct credential exchange to the legitimate token endpoint. The flaw broke the second layer. When the SDK failed to validate the token endpoint, it became a channel through which credentials leaked from the first trust layer to an attacker.

This type of vulnerability underscores a broader pattern: credential handling code in SDKs and libraries benefits from extra scrutiny because a single flaw affects all applications using that code.

The fix in version 1.30.0 enforces validation of the token endpoint before the SDK sends credentials to it. The patched version now verifies that the endpoint belongs to the expected OAuth provider and not to a server controlled by the MCP client. This validation prevents an attacker from redirecting the credential exchange to their own server.

The exact validation mechanism depends on the OAuth configuration and provider, but typically includes checking the endpoint's domain against a whitelist, verifying TLS certificates, or confirming the endpoint is registered with the expected OAuth provider.

The MCP Python SDK OAuth vulnerability is a reminder that credential handling in widely used libraries can put thousands of applications at risk if security assumptions go unchecked. Even established frameworks have gaps. The good news is the fix is simple: update your SDK version immediately and ensure your deployment pipeline restarts all running instances.

Check your project's MCP Python SDK version right now. If it is below 1.30.0, update it today and document the change in your deployment log.

Q: Can this vulnerability be exploited if I use MCP servers from trusted sources only? A: Only if the trusted source has not been compromised. A malicious actor could impersonate a trusted server, compromise its infrastructure, or trick you into using a server you believe is trusted. The vulnerability means the SDK itself offers no defense against these scenarios.

Q: Will updating to version 1.30.0 break my existing code? A: The patch is a security fix and should not introduce breaking changes to normal use cases. However, test the update in a development environment before deploying to production to verify compatibility with your application.

Q: What if I have already deployed a vulnerable version? A: Update and redeploy immediately. Then rotate any OAuth credentials that the vulnerable version handled, especially client secrets. Review API access logs for any unexpected activity during the time the vulnerable version was running.

Q: Does this flaw affect other OAuth-using libraries the same way? A: Not necessarily. Each SDK has different validation logic. However, this incident highlights why credential handling code in any library deserves review. Use the opportunity to audit how your application validates token endpoints, regardless of which libraries it uses.

Source: The Hacker News