CVE-2026-104850

7.5 HIGHpublic exploit available

Published 2026-10-06 · Updated 2026-10-06

AI risk analysis

Summary: The MCP TypeScript SDK has a critical flaw in its OAuth client implementation where stored credentials are not bound to their originating authorization server. This allows malicious or compromised MCP servers to trick clients into sending refresh tokens and client secrets to wrong authorization servers, potentially leading to unauthorized access to user accounts.
Exploitability: Exploitation is relatively straightforward for attackers who can compromise or control an MCP server, requiring no user interaction as the client automatically sends stored credentials to the malicious server's authorization endpoint.
Blast radius: The impact could be significant across all applications using the SDK as an MCP client over HTTP with trusted but unverified MCP servers, potentially allowing attackers to hijack user sessions and access protected resources.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to @modelcontextprotocol/sdk 1.31.0 (for 1.x versions) or @modelcontextprotocol/client 2.2.0 (for 2.x versions) to patch the OAuth credential binding vulnerability.

oauthcredential-hijackingmcpsdk

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Starting in version 1.12.0 and prior to versions 1.31.0 and 2.2.0, the SDK's OAuth client support let the MCP server a client connected to decide which authorization server received the client's OAuth credentials. Stored and pre-provisioned credentials were not bound to the authorization server they belong to. A malicious or compromised MCP server could name its own authorization server in its protected resource metadata. Without any user interaction, the client would send that server the `refresh_token` and `client_secret` stored from an earlier sign-in (1.x), or the configured `client_secret` or signed assertion of a bundled non-interactive provider (1.x and 2.x). Only those applications that use the SDK as an MCP client over HTTP with an `authProvider`: your own `OAuthClientProvider`, or the bundled `ClientCredentialsProvider`, `PrivateKeyJwtProvider`, `StaticPrivateKeyJwtProvider` or (2.x) `CrossAppAccessProvider` and that may connect to an MCP server the owners does not fully trust while holding credentials for a legitimate authorization server are affected. `@modelcontextprotocol/sdk` 1.31.0 (1.x) and `@modelcontextprotocol/client` 2.2.0 (2.x) patch the issue. A workaround for those who cannot upgrade is available. 2.0.0 and 2.1.0 already accept `expectedIssuer`. On 1.x, the only workaround is to connect OAuth-enabled clients only to MCP servers you trust.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses

CWE-345, CWE-522

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.