Cpe:2.3:a:rmcp_project:rmcp:*:*:*:*:*:rust:*:*

The rmcp library fails to validate the resource parameter during OAuth metadata discovery per RFC 9728, allowing attackers to spoof metadata and steal access tokens for legitimate MCP servers.