Because the SDK trusts the MCP server to designate the authorization server endpoint, a malicious or compromised MCP server can redirect authentication traffic to an attacker-controlled server. When the client attempts to authenticate or refresh a token, it inadvertently transmits sensitive data - including refresh_token, client_secret, and signed assertions - directly to the attacker. This flaw persists across various connection methods, including withOAuth() middleware and direct fetchToken() calls, posing a significant risk of credential theft for any client configured to connect to untrusted MCP infrastructure.

Impact

Successful exploitation allows for the complete exfiltration of OAuth credentials and client secrets. If an affected client has previously connected to a malicious MCP server, an attacker can obtain valid refresh tokens, facilitating ongoing unauthorized access to the user's resources on the legitimate authorization server. This vulnerability affects applications using the MCP SDK to facilitate OAuth flows, potentially impacting any organization leveraging the Model Context Protocol to integrate third-party tools that are not strictly internally managed.

Recommendation

1. Patch immediately by upgrading @modelcontextprotocol/sdk to 1.31.0 or later, and @modelcontextprotocol/client / @modelcontextprotocol/core to 2.2.0 or later.
2. Audit existing OAuth integrations for bundled providers; explicitly pass the expectedIssuer parameter to prevent the client from trusting arbitrary endpoints.
3. Rotate all client_secret values and signing keys, and revoke any refresh_tokens associated with clients that have connected to untrusted MCP servers.
4. Manually clear or update persisted tokens stored in file systems, keychains, or databases that lack an associated issuer field to ensure they are re-validated upon next use.
5. If immediate patching is not possible, restrict MCP server connections to trusted, verified endpoints only.