Research

Official MCP Python SDK Flaw Can Let Malicious Servers Steal OAuth Credentials

Why it matters: If an app built on the MCP Python SDK connects to MCP servers you do not run while holding OAuth credentials, upgrade to 1.30.0 or 2.2.0 - a malicious server can redirect those credentials to itself.

Covered by 1 outlet

  • The Hacker News - Official MCP Python SDK Flaw Can Let Malicious Servers Steal OAuth Credentials ()

Published

Start with real signal

See your security surface before you subscribe.

Run the complete AYAsec workflow on Free, then move to the cadence your team needs.

Start scanning free