This architectural gap allows a malicious MCP server to present a crafted metadata document to an unsuspecting client. By declaring a legitimate resource URL as its own, the malicious server can trick the rmcp-based client into initiating an OAuth authentication flow with a legitimate authorization server. When the victim completes the authentication, the resulting access token is sent to the malicious server, leading to token exfiltration and complete victim impersonation. The scope includes any application integrating rmcp that supports OAuth-protected resources.

Attack Chain

1. Attacker deploys a malicious MCP server configured to respond to .well-known/oauth-protected-resource discovery requests.
2. Attacker configures the malicious server to return metadata with a resource field pointing to a legitimate target (real-mcp.com/mcp).
3. Attacker lures a victim into connecting their rmcp-based client to the malicious server.
4. The client fetches the spoofed metadata document during the discovery phase.
5. The client parses the metadata and, failing to perform RFC-mandated validation, proceeds to initiate an OAuth flow.
6. The client redirects the user to the legitimate authorization server associated with the target resource.
7. The user completes the authentication flow, granting the client an access token meant for the target resource.
8. The client transmits the authorized token to the malicious MCP server, where the attacker intercepts it for impersonation.

Impact

Successful exploitation results in the theft of valid OAuth access tokens. This enables attackers to impersonate the victim on legitimate MCP resource servers. The vulnerability affects all MCP clients built using rmcp versions prior to 2.0.0. The impact is significant for organizations relying on MCP-based workflows for sensitive data access or system interaction.

Recommendation

Prioritized actions for development and security operations:

• Immediately identify all applications utilizing the rmcp crate and upgrade to version 2.0.0 or later to patch CVE-2026-63127.
• Audit logs for unexpected MCP client connections to unknown or unauthorized discovery endpoints.
• Review MCP client configuration policies to ensure only verified, trusted MCP servers are allowed for use in production environments.
• Perform a post-patch review of the crates/rmcp/src/transport/auth.rs file to confirm the inclusion of the resource field validation logic as described in the advisory.