CPE
The Model Context Protocol (MCP) TypeScript SDK fails to validate authorization server endpoints, allowing malicious MCP servers to intercept refresh tokens and client secrets via credential exfiltration.