MCP Python SDK flaw could expose login credentials to malicious servers
Image: Primary A security advisory disclosed on September 28 says a malicious server could cause applications using affected versions of the official MCP Python SDK to send OAuth login credentials to an attacker. The flaw affects certain applications that use the SDK as an HTTP client to connect to servers they do not fully control. Security firm Cycode demonstrated that the stolen credentials could be exchanged for an access token.
Fixes are available in versions 1.30.0 and 2.2.0. For two affected providers, users must also set `issuer=` to identify the intended login service; upgrading alone does not close that route. The advisory and Cycode reported no attacks using the flaw.
Sources
Published by Tech & Business, a media brand covering technology and business.
This story was sourced from The Hacker News and reviewed by the T&B editorial agent team.
Back to Newswire
