Official MCP TypeScript SDK Sends OAuth Credentials to Rogue Servers (CVE-2026-104850)
Key Takeaways
- CVE-2026-104850 affects the official MCP TypeScript SDK and was published on October 6, 2026.
- A malicious or compromised MCP server could name its own authorization server and receive the client's OAuth credentials.
- Exposed secrets include stored refresh tokens and client secrets, with no user interaction required.
- Versions 1.31.0 and 2.2.0 fix the flaw; no exploitation has been reported.
The Server Picks Where Your Secrets Go
The official TypeScript SDK for the Model Context Protocol let a connected server decide where a client's OAuth credentials were sent. As the GitLab Advisory Database notes, a malicious server could collect those secrets silently.
What We Know
The advisory, GHSA-6qxp-vccf-f47h, was published on October 6, 2026, with a CVSS score of 7.5. It affects versions 1.12.0 up to 1.31.0 of the SDK, and 2.0.0 up to 2.2.0 of the newer client package.
According to the OSV advisory record, versions 2.0.0 and 2.1.0 already accept an expected issuer setting that reduces the risk. On 1.x, the only workaround is to connect OAuth clients only to trusted servers.
No exploitation has been reported. The flaw follows a similar issue in the official MCP Python SDK, already on the tracker.
What Could Happen
MCP servers that require sign-in tell the client which authorization server to use. The affected SDK accepted that choice without tying stored credentials to the server they were issued by.
A malicious or hijacked MCP server could therefore point the client at an attacker's authorization server. The client would then send the refresh token and client secret from an earlier sign-in, or the secret configured for a non-interactive provider.
No user action was required. Because the SDK sits under many MCP clients, one flaw quietly reached every application built on it.
Why It Matters
Stolen refresh tokens and client secrets let an attacker impersonate a legitimate client and reach the APIs those credentials protect. That can include business data and downstream tools.
The issue sits in the official SDK, so exposure spreads through every product that embeds it. Many teams may not know which of their tools use it.
MCP authorization is still maturing. Organizations should treat server connections as trust decisions and keep an inventory of SDK versions in use.
PointGuard AI Perspective
CVE-2026-104850 is a reminder that MCP trust starts at authentication. PointGuard AI helps enterprises take control of that layer.
The PointGuard MCP Security Gateway acts as a centralized policy enforcement point in front of MCP servers. Organizations decide which servers agents may reach, and every call is authenticated and inspected consistently.
With Agent Identity and Access Security, agents authenticate through OAuth 2.0 flows with short-lived tokens bound to their own cryptographic identity. Secrets are brokered through HashiCorp Vault, AWS Secrets Manager, or Azure Key Vault rather than stored in clients.
PointGuard AI supply chain security helps teams track the open-source components and MCP servers in their AI stack, so a vulnerable SDK version can be found quickly.
As MCP adoption grows, trustworthy AI depends on authorization that the enterprise controls, not the server.
Incident Scorecard Details
Total AISSI Score: 5.60/10
Criticality: 7, OAuth refresh tokens and client secrets protect downstream APIs and data. AISSI weighting: 25%
Propagation: 8, The flaw sits in the official SDK used by many MCP clients. AISSI weighting: 20%
Exploitability: 2, No public proof of concept or observed abuse. AISSI weighting: 15%
Supply Chain: 8, Risk originates in a widely embedded open-source SDK. AISSI weighting: 15%
Business Impact: 3, Patched with no reported harm, potential exposure only. AISSI weighting: 25%
Sources
Third-Party Sources
PointGuard AI Sources
AI Security Severity Index (AISSI)
0/10
Threat Level
Criticality
7
Propagation
8
Exploitability
2
Supply Chain
8
Business Impact
3
Scoring Methodology
Category
Description
weight
Criticality
Importance and sensitivity of theaffected assets and data.
25%
PROPAGATION
How easily can the issue escalate or spread to other resources.
20%
EXPLOITABILITY
Is the threat actively being exploited or just lab demonstrated.
15%
SUPPLY CHAIN
Did the threat originate with orwas amplified by third-partyvendors.
15%
BUSINESS IMPACT
Operational, financial, andreputational consequences.
25%
Watch Incident Video
Learn More