OAuth Credential Theft in MCP Python SDK: Security Advisory Breakdown

The flaw allows a malicious MCP server to intercept and capture three critical pieces of information during the OAuth authentication flow: the client secret, the authorization code, and the PKCE proof key. Instead of sending these to the legitimate token endpoint operated by the service your application is trying to log into, the compromised server redirects them to an attacker-controlled endpoint. Once the attacker receives these values, they can trade them for valid access tokens and fully impersonate your application.

This is not a weakness in the OAuth protocol itself, which has built-in protections like PKCE (Proof Key for Code Exchange) specifically to prevent token theft. The problem lies in how the SDK was written: it failed to properly validate the token endpoint URL before sending credentials to it.

An MCP application typically connects to one or more MCP servers to extend its capabilities. During setup, a user might add a server URL provided by a colleague, found in a public registry, or bundled with a plugin. If that server is malicious or has been compromised, it can respond to the client's OAuth initiation request with a fake token endpoint URL pointing to attacker infrastructure.

The vulnerable SDK versions do not verify that this endpoint belongs to the legitimate OAuth provider. They simply accept whatever URL the server specifies and send the credential bundle there. A real-world scenario: you use a development or productivity tool built on MCP, add what appears to be a legitimate plugin server, and that server steals your GitHub, Google or Slack OAuth tokens. The attacker then has programmatic access to those accounts.

The MCP Python SDK maintainers released a security advisory confirming the flaw exists in versions prior to 1.30.0. If your application or tool depends on an earlier version of the SDK, you are at risk. Check your `requirements.txt`, `pyproject.toml`, or `setup.py` to confirm which version you have installed.

The fix in 1.30.0 and later versions includes proper validation of the token endpoint URL, ensuring it matches the expected OAuth provider before any credentials are sent. Upgrading is the only reliable mitigation.

According to security-vendor incident reports on SDK vulnerabilities, the most dangerous class of flaws are those that affect the authentication layer because they create a trust bridge between multiple systems. Once compromised, a single SDK version can affect thousands of downstream applications without the end users being aware of the risk. MCP is still relatively new, meaning many developers may not have updated their dependencies recently or may not know that their tool depends on the SDK at all.

Law enforcement and corporate incident-response teams have observed that OAuth credential theft is a common first step in account takeover and supply-chain attacks. An attacker who obtains OAuth tokens for a service with broad API access can move laterally across an organization's infrastructure without triggering network-level alarms because the traffic appears legitimate and authorized.

The fact that this flaw was in an official SDK rather than a third-party wrapper makes it especially significant. Developers often assume that official projects are more thoroughly vetted, which can lower their guard when it comes to dependency updates and security advisories.

If you maintain an application or tool built on the MCP Python SDK, take these steps:

1. Check the version of mcp installed in your project by running pip show mcp or reviewing your dependency file.
2. If the version is earlier than 1.30.0, update to 1.30.0 or the latest available version immediately.
3. Test your application thoroughly after upgrading to ensure no breaking changes.
4. Review any OAuth tokens your application uses to verify they have not been accessed by unauthorized parties.
5. Consider rotating those tokens as a precaution, especially if your application has broad API permissions.
6. If your tool allows users to add custom MCP servers, audit that list and remove any servers you do not recognize or trust.

Beyond patching, several operational practices reduce the risk of similar flaws affecting you in the future. Use the principle of least privilege when configuring OAuth scopes: request only the permissions your application actually needs. If your tool integrates with GitHub, Google, Slack or another service, lock down which accounts or teams can add new plugin servers or customize API integrations.

Monitor your OAuth token usage and logs for unusual activity, especially authorization events from unfamiliar IP addresses or at odd hours. If you use an OAuth provider that supports it, enable email notifications whenever a new application requests access to your account. Treat OAuth tokens with the same care as passwords: do not log them, do not store them in version control, and rotate them regularly if they have broad access.

As more tools adopt the Model Context Protocol, this vulnerability is a timely reminder that new ecosystems inherit the same security challenges as older ones. Dependency management, SDK security, and credential handling matter just as much in a cutting-edge architecture as they do in legacy systems. Before integrating a new MCP server into a production workflow, verify its source and check whether its maintainer has a track record of responding to security reports.

The MCP community and maintainers should be credited for disclosing this flaw publicly and releasing a fix. This transparency is how the ecosystem builds trust. Your responsibility as a user or developer is to apply the patch and to treat third-party server integration with appropriate caution.

Can I use an MCP application safely while waiting for a patch? Not if it will connect to untrusted or unverified MCP servers. If you can limit the application to known, reputable servers only, the risk is lower. However, patching is the only complete mitigation.

Does this vulnerability affect MCP servers written in other languages? No, the vulnerability is specific to the official Python SDK. Projects using the MCP protocol in Go, JavaScript, Rust or other languages are not affected unless they made the same mistake in their implementation.

How do I know if my OAuth token was stolen? Check the activity log or security settings of the service whose token is integrated. If you see authorization from unfamiliar IP addresses or applications you did not approve, assume compromise and rotate the token immediately.

Will upgrading to 1.30.0 break my code? Unless you relied on the buggy behavior specifically, no. Breaking changes are typically flagged in release notes. Review the changelog and test in a staging environment first.

What should I do if I suspect my OAuth credentials were stolen? Revoke the token immediately in the OAuth provider's settings, then re-authorize your application from scratch. If the token had broad permissions, change your password for that service as well and monitor for suspicious activity.

Source: The Hacker News