CVE-2026-104850High· 7.5▾ MidnightPoC availableMCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Starting in version 1.12.0 and prior to versions 1.31.0 and 2.2.0, the SDK's OAuth client support let the MCP server a client connected to …
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Exploit / PoC code exists
0.2% → 0.2%
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Starting in version 1.12.0 and prior to versions 1.31.0 and 2.2.0, the SDK's OAuth client support let the MCP server a client connected to decide which authorization server received the client's OAuth credentials. Stored and pre-provisioned credentials were not bound to the authorization server they belong to. A malicious or compromised MCP server could name its own authorization server in its protected resource metadata. Without any user interaction, the client would send that server the refresh_token and client_secret stored from an earlier sign-in (1.x), or the configured client_secret or signed assertion of a bundled non-interactive provider (1.x and 2.x). Only those applications that use the SDK as an MCP client over HTTP with an authProvider: your own OAuthClientProvider, or the bundled ClientCredentialsProvider, PrivateKeyJwtProvider, StaticPrivateKeyJwtProvider or (2.x) CrossAppAccessProvider and that may connect to an MCP server the owners does not fully trust while holding credentials for a legitimate authorization server are affected. @modelcontextprotocol/sdk 1.31.0 (1.x) and @modelcontextprotocol/client 2.2.0 (2.x) patch the issue. A workaround for those who cannot upgrade is available. 2.0.0 and 2.1.0 already accept expectedIssuer. On 1.x, the only workaround is to connect OAuth-enabled clients only to MCP servers you trust.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
@modelcontextprotocol/sdk >= 1.12.0, < 1.31.0@modelcontextprotocol/client >= 2.0.0, < 2.2.0Patched in:
@modelcontextprotocol/sdk 1.31.0@modelcontextprotocol/client 2.2.0Source: https://github.com/advisories/GHSA-6qxp-vccf-f47h
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-63127High· 8.2RMCP is an official Rust SDK for the Model Context Protocol
CVE-2026-63128High· 7.5RMCP is an official Rust SDK for the Model Context Protocol
CVE-2026-114612Critical· 9.9LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key
CVE-2026-102946Critical· 9.1joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards
CVE-2026-109527High· 7.5The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients
CVE-2026-59951Medium· 6.9The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP)