Tag

Cve-2026-104850

1 brief RSS

Credential Exfiltration Vulnerability in MCP TypeScript SDK OAuth Implementation

The Model Context Protocol (MCP) TypeScript SDK fails to validate authorization server endpoints, allowing malicious MCP servers to intercept refresh tokens and client secrets via credential exfiltration.

@modelcontextprotocol/sdk +1 credential-theft vulnerability mcp oauth cve-2026-104850

1t 1c 2d ago