Breaking

Malicious MCP Servers Can Expose OAuth Credentials in Affected MCP Python SDK Clients

September 29, 2026 at 02:12 EDT

AI Agents
Security

A newly reported vulnerability in affected MCP Python SDK clients can let a malicious Model Context Protocol server obtain OAuth credential material during an authorization flow, including a client secret, authorization code and PKCE verifier. If those values are exposed together, an attacker may be able to exchange them with the legitimate service for a valid access token.

Sep. 29, 2026 · MCP OAuth

Malicious MCP servers can expose OAuth keys

Affected MCP Python SDK clients can leak the combination of client secret, authorization code and PKCE verifier, giving an attacker the material needed to request a real access token.

credential artifacts can be exposed together

OAuth defenses highlighted: issuer and resource checks

valid access token may be requested if the flow is compromised

Credential bundle at risk

3 artifacts

client secret, code, PKCE verifier

Why the bundle matters: PKCE protects an intercepted authorization code only while the verifier remains secret. If both the code and verifier leak, the attacker can try the real token exchange.

Compromise path

Connect

Client reaches a hostile MCP server

→

Capture

OAuth artifacts leave the client boundary

→

Exchange

Attacker requests a legitimate access token

Defensive pattern

Validate issuer identity, bind tokens to the intended resource, and separate stored credentials by issuer and resource.

Operator concern

Remote MCP discovery makes setup easier, but it also gives untrusted servers influence over sensitive authentication flows.

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.