What happened
The MCP TypeScript SDK's HTTP client transports and OAuth client functions followed cross-origin redirects while preserving custom headers and (for 307/308) request bodies. A malicious or compromised MCP or authorization server can therefore receive OAuth refresh tokens, client secrets, API keys and session identifiers.
Why it matters
MCP clients hold the credentials that let an agent act; a single cross-origin redirect on the transport can exfiltrate the OAuth refresh token or client secret that authenticates the agent to downstream services, enabling credential theft from an otherwise-trusted agent integration.
Attack vector
The HTTP client transports and OAuth client requests follow redirects to a different origin while retaining custom request headers and, for HTTP 307/308, request bodies. Custom headers (including mcp-session-id) and OAuth request bodies containing refresh_token and client_secret can be re-sent to the redirected origin.
Affected systems
@modelcontextprotocol/sdk < 1.32.0; @modelcontextprotocol/client >= 2.0.0, < 2.3.0
Mitigation
Upgrade to @modelcontextprotocol/sdk 1.32.0 / @modelcontextprotocol/client 2.3.0. Advisory: https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-6prh-2h8m-c8cw