MCP Python SDK flaw lets malicious servers steal OAuth credentials

Affected Systems

Anthropic MCP Python SDK versions 1.9.1–1.29.1 (1.x line) and 2.0.0–2.1.1 (2.x line). Affects MCP clients using HTTP with OAuth providers (OAuthClientProvider, ClientCredentialsOAuthProvider, PrivateKeyJWTOAuthProvider, RFC7523OAuthClientProvider) that connect to untrusted servers. MCP servers, local stdio clients, and clients using custom tokens are not affected.

Exploitation Status

No active exploitation reported. Proof-of-concept demonstrated by Cycode in controlled testing. Flaw was silently fixed in release notes on September 7 before public advisory on September 28.

Business Impact

Malicious MCP servers can steal OAuth client secrets, authorization codes, and PKCE proof keys by redirecting token requests to attacker-controlled endpoints. Stolen credentials allow attackers to obtain valid access tokens with full application permissions. Client secrets are long-lived and remain valid until rotated. CVSS 7.5 (high) for machine-to-machine providers; 6.5 (medium) for interactive flows. No CVE assigned as of September 29.

Urgency

🟠 Within 24 hours

Recommended Actions

• Upgrade MCP Python SDK to version 1.30.0 (1.x line) or 2.2.0 (2.x line) immediately.
• For ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider: pass issuer= parameter explicitly to specify the expected authorization server after upgrading.
• Clear all stored OAuth client registrations once after upgrade, as older registrations lack issuer binding.
• If clients may have connected to untrusted MCP servers, rotate client secrets and revoke tokens at the OAuth authorization server.
• Audit MCP client configurations to ensure connections only to trusted MCP servers; restrict network access if needed.