What happened
GitHub Security Advisory / NVD disclosed on Sept 16, 2026 that rmcp's OAuth transport logic (auth.rs) fails to bind issued tokens to the intended resource server, letting a malicious MCP server obtain a legitimate access token intended for a different service.
Why it matters
rmcp is an official, widely embedded SDK for building MCP clients/servers; a token-impersonation flaw in its OAuth flow can let a malicious or compromised MCP server capture credentials meant for a completely different trusted service, undermining the OAuth delegation model MCP relies on for secure agent-to-tool authentication.
Attack vector
The rmcp OAuth implementation omits the RFC 9728 'resource' field from ResourceServerMetadata and permits discover_oauth_server_via_resource_metadata to trust protected-resource metadata from an untrusted source, allowing a malicious MCP server to publish metadata claiming to be a different legitimate resource; a victim connecting to the malicious server can be tricked into obtaining and sending a legitimate access token to the attacker, who then impersonates the victim against the real service.
Affected systems
rmcp (Rust MCP SDK) < 2.0.0
Mitigation
Upgrade rmcp to >= 2.0.0; verify OAuth resource-server metadata includes and validates the RFC 9728 resource field before token exchange.