A vulnerability in the official Model Context Protocol (MCP) Python SDK allows malicious servers to intercept sensitive OAuth credentials. Due to improper handling during the authentication flow, client secrets, authorization codes, and PKCE keys are inadvertently sent to attacker-controlled token endpoints. Developers must immediately upgrade to SDK version 1.30.0 or later to mitigate this security flaw.
READ THE ORIGINAL ARTICLE AT THEHACKERNEWS.COM →