What happened
Cycode documented a flaw in the official MCP Python SDK (1.9.1–1.29.1 and 2.0.0–2.1.1, CVSS 7.5 for machine-to-machine providers): during OAuth discovery a malicious MCP server can return a 404, forcing the SDK into a legacy fallback path where it trusts the server's OAuth config without validating the declared issuer. The SDK sends the authorization code, client secret and PKCE verifier to an attacker-controlled token endpoint, defeating PKCE and yielding a valid token for the AI agent account. Fixed in 1.30.0 and 2.2.0, which validate the authorization-server issuer.
Why it matters
HTTP-based MCP clients using OAuth (Google, Okta, Entra ID) can be tricked into surrendering long-lived credentials to a rogue server. This is especially dangerous for agents that autonomously pick MCP servers, where a hijacked registry entry, typosquat, DNS hijack or prompt-injection-influenced choice can redirect the client. Patched versions require passing issuer= explicitly for ClientCredentialsOAuthProvider/PrivateKeyJWTOAuthProvider; upgrading alone is not sufficient.
Attack vector
Malicious/compromised MCP server drives the client into the legacy OAuth discovery fallback, then receives the auth code, client secret and PKCE verifier
Affected systems
official MCP Python SDK 1.9.1–1.29.1 and 2.0.0–2.1.1 (HTTP-based MCP clients using OAuth)
Mitigation
Upgrade to MCP Python SDK 1.30.0 (1.x) or 2.2.0 (2.x), set the expected issuer= parameter, rotate exposed client secrets and revoke tokens for any app that connected to an untrusted server