Model Context Protocol (MCP) TypeScript software development kit (SDK): a malicious MCP server can make a connected client send it stored OAuth credentials with no user interaction, patched 28 September 2026

Changes to what this case says, with the reason. Every earlier version is kept.

• 2026-10-22: Outcome: regime consequence. Rule 13 (new cases): the consequence line records only actions by a regulator, court, legislature or other government body; a cve, an advisory, a score or a fix is not one. the cve and fix details are already in the evidence and recovery fields, so nothing is lost. found while drafting this case's letters, 22 october 2026.
  Show the change

  Before: CVE-2026-104850 (GHSA-6qxp-vccf-f47h); patched in @modelcontextprotocol/sdk 1.31.0 and @modelcontextprotocol/client 2.2.0, both released 28 September 2026; bundled providers, credentials saved before upgrading and custom providers also need changes beyond upgrading

  After: none
• 2026-10-21: Status text. Editor's call h4 of 21 october 2026 (accepted as amended, pull request #79): the advisory says upgrading alone is not enough in some setups ('you also need to make a change', ghsa-6qxp-vccf-f47h).
  Show the change

  Before: Confirmed (fixed; no exploitation reported)

  After: Confirmed (patched; some setups need changes beyond upgrading; no exploitation reported)
• 2026-10-21: Outcome: regime consequence. Found in the editor's second, independent check of the interpretations, 21 october 2026: third check: matches the corrected interpretation; the advisory says 'upgrading to the patched version is not enough. you also need to make a change' (ghsa-6qxp-vccf-f47h).
  Show the change

  Before: CVE-2026-104850 (GHSA-6qxp-vccf-f47h); patched in @modelcontextprotocol/sdk 1.31.0 and @modelcontextprotocol/client 2.2.0, both released 28 September 2026; bundled providers, credentials saved before upgrading and custom providers also need configuration changes

  After: CVE-2026-104850 (GHSA-6qxp-vccf-f47h); patched in @modelcontextprotocol/sdk 1.31.0 and @modelcontextprotocol/client 2.2.0, both released 28 September 2026; bundled providers, credentials saved before upgrading and custom providers also need changes beyond upgrading
• 2026-10-21: Inference: value. Found in the editor's second, independent check of the interpretations, 21 october 2026: a vulnerability-tracking site (thehackerwire) lists a public proof-of-concept repository for this flaw that the check could not open, so the statement is limited to the case's sources.
  Show the change

  Before: The record shows that the OAuth client in the Model Context Protocol (MCP) TypeScript software development kit did not tie stored or configured credentials to the authorization server they came from, so an MCP server the client connected to could name a different authorization server and the client would send it those credentials without asking the user. The maintainers' patch records that server as the credentials' issuer and refuses to send them elsewhere, but by the advisory's own account it needs changes beyond upgrading in several setups and does not cover a new interactive sign-in. The record does not show that anyone exploited the flaw, and it contains no public demonstration of an attack

  After: The record shows that the OAuth client in the Model Context Protocol (MCP) TypeScript software development kit did not tie stored or configured credentials to the authorization server they came from, so an MCP server the client connected to could name a different authorization server and the client would send it those credentials without asking the user. The maintainers' patch records that server as the credentials' issuer and refuses to send them elsewhere, but by the advisory's own account it needs changes beyond upgrading in several setups and does not cover a new interactive sign-in. The record does not show that anyone exploited the flaw, and none of its sources includes a demonstration of an attack
• 2026-10-21: Inference: value. Found in the editor's second, independent check of the interpretations, 21 october 2026: two of the advisory's three setups need a stored-data or code change, not configuration: 'upgrading to the patched version is not enough. you also need to make a change' (ghsa-6qxp-vccf-f47h).
  Show the change

  Before: The record shows that the OAuth client in the Model Context Protocol (MCP) TypeScript software development kit did not tie stored or configured credentials to the authorization server they came from, so an MCP server the client connected to could name a different authorization server and the client would send it those credentials without asking the user. The maintainers' patch records that server as the credentials' issuer and refuses to send them elsewhere, but by the advisory's own account it needs configuration changes in several setups and does not cover a new interactive sign-in. The record does not show that anyone exploited the flaw, and it contains no public demonstration of an attack

  After: The record shows that the OAuth client in the Model Context Protocol (MCP) TypeScript software development kit did not tie stored or configured credentials to the authorization server they came from, so an MCP server the client connected to could name a different authorization server and the client would send it those credentials without asking the user. The maintainers' patch records that server as the credentials' issuer and refuses to send them elsewhere, but by the advisory's own account it needs changes beyond upgrading in several setups and does not cover a new interactive sign-in. The record does not show that anyone exploited the flaw, and it contains no public demonstration of an attack
• 2026-10-21: Inference: value. Found in the editor's second, independent check of the interpretations, 21 october 2026: abbreviations spelled out (sdk, mcp), as in the case title.
  Show the change

  Before: The record shows that the SDK's OAuth client did not tie stored or configured credentials to the authorization server they came from, so an MCP server the client connected to could name a different authorization server and the client would send it those credentials without asking the user. The maintainers' patch records that server as the credentials' issuer and refuses to send them elsewhere, but by the advisory's own account it needs configuration changes in several setups and does not cover a new interactive sign-in. The record does not show that anyone exploited the flaw, and it contains no public demonstration of an attack

  After: The record shows that the OAuth client in the Model Context Protocol (MCP) TypeScript software development kit did not tie stored or configured credentials to the authorization server they came from, so an MCP server the client connected to could name a different authorization server and the client would send it those credentials without asking the user. The maintainers' patch records that server as the credentials' issuer and refuses to send them elsewhere, but by the advisory's own account it needs configuration changes in several setups and does not cover a new interactive sign-in. The record does not show that anyone exploited the flaw, and it contains no public demonstration of an attack
• 2026-10-21: Sources: nvd-104850: title. Found in the editor's source check of 21 october 2026: the nvd record carries github's cve description, a shorter text than the maintainers' advisory that omits its 'not enough' and 'not covered' sections, so 'text of maintainer advisory' was inaccurate; the record's own title added and its status recorded (read through the nvd application programming interface, as the web page renders by script).
  Show the change

  Before: NVD record CVE-2026-104850 (CNA: GitHub), text of maintainer advisory, CVSS 3.1 7.5

  After: National Vulnerability Database (NVD) record CVE-2026-104850, 'MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server' (CVE numbering authority: GitHub); CVE description and CVSS 3.1 score 7.5 supplied by GitHub; NVD status Awaiting Analysis
• 2026-10-21: Inference: value. Found in the editor's source check of 21 october 2026: the earlier wording stated a general rule the sources do not state and said the client 'will hand it to whoever asks', beyond the affected set the maintainers' advisory (ghsa) defines; it also did not say what the record does not show (no exploitation, per the cisa enrichment in the cve record; no public proof of concept; a patch with stated limits). the interpretation was unsigned, so no signature was cleared.
  Show the change

  Before: {"value": "A credential has to be bound to where it May be presented; if the party asking for it can also name where it goes, the client will hand it to whoever asks.", "source_ids": ["NVD-104850"]}

  After: {"value": "The record shows that the SDK's OAuth client did not tie stored or configured credentials to the authorization server they came from, so an MCP server the client connected to could name a different authorization server and the client would send it those credentials without asking the user. The maintainers' patch records that server as the credentials' issuer and refuses to send them elsewhere, but by the advisory's own account it needs configuration changes in several setups and does not cover a new interactive sign-in. The record does not show that anyone exploited the flaw, and it contains no public demonstration of an attack.", "source_ids": ["GHSA", "NVD-104850"]}
• 2026-10-21: Fields: recovery accountability. Found in the editor's source check of 21 october 2026: the cited nvd and gitlab records carry no reporter credits or disclosure history; the repository advisory (ghsa) credits three reporters and was published 30 september 2026, after the 28 september releases (fix-1x, rel-220).
  Show the change

  Before: {"value": "Coordinated disclosure through the maintainer's security advisory", "source_ids": ["NVD-104850", "GLAD"]}

  After: {"value": "Coordinated disclosure through the maintainers' security advisory, which credits three reporters; the patched releases (28 September 2026) came out two days before the advisory was published (30 September 2026)", "source_ids": ["GHSA", "FIX-1X", "REL-220"]}
• 2026-10-21: Fields: recovery technical. Found in the editor's source check of 21 october 2026: the maintainers' advisory (ghsa) says upgrading is not enough in three setups, lists three cases 'not covered by this fix', and advises rotating secrets and revoking tokens; the field said only 'fixed'; release date from fix-1x and rel-220.
  Show the change

  Before: {"value": "Fixed in @modelcontextprotocol/sdk 1.31.0 and @modelcontextprotocol/client 2.2.0; 2.0.0 and 2.1.0 already accept expectedIssuer; on 1.x the only workaround is to connect OAuth-enabled clients only to trusted MCP servers", "source_ids": ["NVD-104850"]}

  After: {"value": "Patched in @modelcontextprotocol/sdk 1.31.0 and @modelcontextprotocol/client 2.2.0 (and @modelcontextprotocol/core 2.2.0 if imported directly), released 28 September 2026: the client records the authorization server as issuer on saved credentials and does not send them to a different one. Upgrading is not enough for bundled providers (pass expectedIssuer), credentials saved without an issuer (add it or clear them) or custom OAuthClientProvider implementations (persist issuer). Not covered: a new interactive sign-in, direct refreshAuthorization() and exchangeAuthorization() calls, and 2.x with skipIssuerMetadataValidation: true. The advisory says to rotate the client secret or signing key and revoke tokens if an affected client May have connected to an untrusted MCP server. Workarounds: 2.0.0 and 2.1.0 already accept expectedIssuer; on 1.x, connect OAuth-enabled clients only to trusted MCP servers", "source_ids": ["GHSA", "NVD-104850", "FIX-1X", "REL-220"]}
• 2026-10-21: Fields: evidence event. Found in the editor's source check of 21 october 2026: the repository advisory page (ghsa) shows 'maxisbey published ghsa-6qxp-vccf-f47h sep 30, 2026' and credits three reporters; 6 october 2026 is the date of the github advisory database entry, the cve record and the nvd listing (nvd-104850), where the 7.5 score is github's and nvd has not analysed the record; abbreviations spelled out.
  Show the change

  Before: {"value": "Maintainer advisory GHSA-6qxp-vccf-f47h; NVD record CVE-2026-104850 published 6 October 2026; CVSS 3.1 base 7.5; weaknesses CWE-345 and CWE-522", "source_ids": ["NVD-104850", "GLAD"]}

  After: {"value": "Maintainers' repository advisory GHSA-6qxp-vccf-f47h, published 30 September 2026 and crediting three reporters; GitHub advisory database entry, CVE-2026-104850 record and National Vulnerability Database listing dated 6 October 2026; CVSS (a severity score) version 3.1 base 7.5, High, supplied by GitHub; weaknesses CWE-345 (insufficient verification of data authenticity) and CWE-522 (insufficiently protected credentials)", "source_ids": ["GHSA", "NVD-104850", "GLAD"]}
• 2026-10-21: Outcome: regime consequence. Found in the editor's source check of 21 october 2026: release dates from the maintainers' repository and npm (fix-1x, rel-220); the maintainers' advisory (ghsa) says 'upgrading to the patched version is not enough' for bundled providers, credentials saved without issuer and custom oauthclientprovider implementations.
  Show the change

  Before: CVE-2026-104850 (GHSA-6qxp-vccf-f47h); fixed in @modelcontextprotocol/sdk 1.31.0 and @modelcontextprotocol/client 2.2.0

  After: CVE-2026-104850 (GHSA-6qxp-vccf-f47h); patched in @modelcontextprotocol/sdk 1.31.0 and @modelcontextprotocol/client 2.2.0, both released 28 September 2026; bundled providers, credentials saved before upgrading and custom providers also need configuration changes
• 2026-10-21: Outcome: severity. Found in the editor's source check of 21 october 2026: the 7.5 score comes from github, the cve numbering authority, and the maintainers' advisory (ghsa); the national vulnerability database record (nvd-104850) lists it as a 'secondary' score from security-advisories@github.com and still shows status 'awaiting analysis' when read on 21 october 2026; the case did not say who assigned the score or spell out cvss.
  Show the change

  Before: none reported (CVSS 3.1 base 7.5)

  After: none reported; the maintainers' advisory rates the flaw High, with a CVSS (Common Vulnerability Scoring System, a severity score) version 3.1 base score of 7.5, published by GitHub as the CVE numbering authority; the National Vulnerability Database had not done its own analysis as of 21 October 2026
• 2026-10-21: Context: actor type. Found in the editor's source check of 21 october 2026: the maintainers' advisory (ghsa) and the cve record (nvd-104850) give the affected ranges as @modelcontextprotocol/sdk 1.12.0 through 1.30.1 and @modelcontextprotocol/client 2.0.0 through 2.1.0, the latter 'only for' bundled providers without expectedissuer, credentials stored or supplied without issuer, direct calls to fetchtoken() and providers that read storage back through the schemas; 'any 1.x or 2.x' overstated the affected set.
  Show the change

  Before: Software: an MCP client built on @modelcontextprotocol/sdk 1.x or @modelcontextprotocol/client 2.x with an authProvider

  After: Software: an MCP client over HTTP using the OAuth client of @modelcontextprotocol/sdk 1.12.0 to 1.30.1, or of @modelcontextprotocol/client 2.0.0 to 2.1.0 in specific setups (bundled providers without expectedIssuer, credentials stored or supplied without an issuer, direct fetchToken() calls)
• 2026-10-21: Title. Found in the editor's source check of 21 october 2026: the patched releases were published on 28 september 2026 (commit 51ad4f0 released as @modelcontextprotocol/sdk 1.31.0, and release v2.2.0 of @modelcontextprotocol/client, both published to npm that day; sources fix-1x and rel-220), before the advisory (30 september 2026 in the repository, 6 october 2026 in the github advisory database, the cve record and the national vulnerability database), so 'fixed october 2026' was wrong; 'patched' replaces 'fixed' because the maintainers' advisory (ghsa) lists cases the fix does not cover; abbreviations spelled out.
  Show the change

  Before: MCP TypeScript SDK: a malicious MCP server can make a connected client send it stored OAuth credentials with no user interaction, fixed October 2026

  After: Model Context Protocol (MCP) TypeScript software development kit (SDK): a malicious MCP server can make a connected client send it stored OAuth credentials with no user interaction, patched 28 September 2026
• 2026-10-13: Controls: c-i1. The failure is trusting an unverified issuer, not following instructions in retrieved text; now matches the signal's mapping.
  Show the change

  Before: failed: Retrieved content as data (server-supplied metadata decided where credentials were sent)

  After: failed: Actor identity verification (the client did not verify the authorization server named in the metadata)