An MCP server could choose where your client sent OAuth secrets. Version 1.31.0 stops it.
By Lior AharonovFounder, 7IT Solutions ·
On 6 October 2026 the MCP TypeScript SDK maintainers published CVE-2026-104850, rated High at CVSS 7.5. The OAuth client could send credentials to an authorization server chosen by the MCP server. Affected: @modelcontextprotocol/sdk 1.12.0 to 1.30.1 and @modelcontextprotocol/client 2.0.0 to 2.1.0; fixed in 1.31.0 and 2.2.0.
Your agent connects to a server it found this morning. That server names the login page, and your client secret or signing key goes there. The patch checks the issuer, but only if you tell it which one to expect.
Upgrade to sdk 1.31.0 or client 2.2.0, pass expectedIssuer to the bundled providers, and rotate the client secret and revoke tokens for any client that may have touched an untrusted MCP server.
An OAuth client that lets the server choose the login page is a client that hands out keys on request.
Lior Aharonov · my takeSources
Researched with AI tools; every fact is checked against the linked sources.