Product
The rmcp library fails to validate the resource parameter during OAuth metadata discovery per RFC 9728, allowing attackers to spoof metadata and steal access tokens for legitimate MCP servers.