📋 ADVISORIES
- Official MCP Python SDK Flaw Lets Malicious Servers Steal OAuth Credentials A flaw in the official MCP Python SDK let malicious MCP servers trick client applications into sending OAuth credentials to attacker-controlled endpoints.
- Affects apps using the MCP Python SDK as an MCP client over HTTP with OAuthClientProvider, ClientCredentialsOAuthProvider, PrivateKeyJWTOAuthProvider, or deprecated RFC7523OAuthClientProvider; versions 1.9.1–1.29.1 (1.x) and 2.0.0–2.1.1 (2.x) are vulnerable.
- Malicious servers could redirect the client to an attacker-controlled token endpoint, capturing the client secret, authorization code, and PKCE proof key, enabling account takeover with the app's permissions.
- The client secret is long-lived and remains valid until rotated; the two machine-to-machine providers require no user interaction, while the interactive provider shows the genuine login page.
- Fixed in SDK versions 1.30.0 (1.x) and 2.2.0 (2.x), which validate the expected issuer before fetching server metadata; rated 7.5 (machine-to-machine) and 6.5 (interactive), with no CVE assigned as of September 29.
- Reported by Cycode; no exploitation observed. For ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider, upgrading alone is insufficient — an issuer= parameter must also be set. 📄 Source: github.com · 📎 Coverage: thehackernews.com · 👁 via The Hacker News
📋 ADVISORIES
- 📄 Source for Apple patches CoreGraphics zero-day CVE-2026-86950 exploited in targeted attacks — support.apple.com