Executive Summary
A flaw in the official MCP Python SDK let a malicious MCP server trick applications into sending the OAuth client secret, authorization code and PKCE proof key to an attacker-controlled token endpoint; it is fixed in version 1.30.0 and later.
What Happened
A malicious MCP server could trick an application built on the official MCP Python SDK into handing over the OAuth credentials it uses to log in to a real service, the SDK's maintainers said in a security advisory. Affected versions sent the client secret, the authorization code, and the PKCE proof key to a token endpoint the attacker controlled. The fix is in versions 1.30.0 and
Affected Products
- MCP Python SDK
Vulnerability / Attack Technique
OAuth credential theft by a malicious MCP server
Technical Mechanism
Affected SDK versions accepted a token endpoint supplied by the MCP server and sent the client secret, authorization code and PKCE verifier to it, letting the attacker log in to the real service.
AI Security Category
LLM03:2025 Supply Chain
Part of the MCP Security topic.
Part of the AI Supply Chain and AI SBOM topic.
Relevant Frameworks
RealGround Analysis
Connecting to an MCP server is a trust decision: a hostile server can now steal the credentials an app uses elsewhere. RealGround analysis: MCP SDK versions belong in the AI SBOM, and MCP servers should be allowlisted.
Recommended Controls
- Upgrade the MCP Python SDK to 1.30.0 or later
- Connect only to vetted MCP servers
- Rotate OAuth client secrets used by apps that talked to untrusted MCP servers
Related RealGround Service
AI Security Readiness Assessment · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/09/official-mcp-python-sdk-flaw-can-let.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-17.