Model Context Protocol (MCP) TypeScript software development kit (SDK): a malicious MCP server can make a connected client send it stored OAuth credentials with no user interaction, patched 28 September 2026
The typed evidence object. This is the working store; the case page is the reader's form.
| Layer / facet | Value | Type | Sources | Conf. |
|---|---|---|---|---|
| Mandate: principal | The owner of an application that uses the SDK as an MCP client over HTTP with an authProvider and holds credentials for a legitimate authorization server | fact | National Vulnerability Database (NVD) record CVE-2026-104850, 'MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server' (CVE numbering authority: GitHub); CVE description and CVSS 3.1 score 7.5 supplied by GitHub; NVD status Awaiting Analysis | high |
| Mandate: objective | not evidenced in source | assertion | National Vulnerability Database (NVD) record CVE-2026-104850, 'MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server' (CVE numbering authority: GitHub); CVE description and CVSS 3.1 score 7.5 supplied by GitHub; NVD status Awaiting Analysis | low |
| Actor | The SDK's OAuth client support in an MCP client, holding a stored refresh_token and client_secret (1.x) or the configured client_secret or signed assertion of a bundled non-interactive provider (1.x and 2.x) | fact | National Vulnerability Database (NVD) record CVE-2026-104850, 'MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server' (CVE numbering authority: GitHub); CVE description and CVSS 3.1 score 7.5 supplied by GitHub; NVD status Awaiting Analysis | high |
| Inputs | Protected resource metadata from the MCP server the client connected to, naming the authorization server; a malicious or compromised MCP server could name its own | fact | National Vulnerability Database (NVD) record CVE-2026-104850, 'MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server' (CVE numbering authority: GitHub); CVE description and CVSS 3.1 score 7.5 supplied by GitHub; NVD status Awaiting Analysis | high |
| Decision | The client let the MCP server decide which authorization server received its OAuth credentials, without any user interaction | fact | National Vulnerability Database (NVD) record CVE-2026-104850, 'MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server' (CVE numbering authority: GitHub); CVE description and CVSS 3.1 score 7.5 supplied by GitHub; NVD status Awaiting Analysis; GitLab advisory database entry for @modelcontextprotocol/sdk CVE-2026-104850, citing GHSA-6qxp-vccf-f47h, fix commit edd12e2, pull request 2887 and release v2.2.0 | high |
| Envelope: authority | Stored and pre-provisioned credentials were not bound to the authorization server they belong to | fact | National Vulnerability Database (NVD) record CVE-2026-104850, 'MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server' (CVE numbering authority: GitHub); CVE description and CVSS 3.1 score 7.5 supplied by GitHub; NVD status Awaiting Analysis | high |
| Action | The client sends the refresh_token and client_secret stored from an earlier sign-in (1.x), or the configured client_secret or signed assertion of a bundled non-interactive provider (1.x and 2.x), to the authorization server the MCP server named | fact | National Vulnerability Database (NVD) record CVE-2026-104850, 'MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server' (CVE numbering authority: GitHub); CVE description and CVSS 3.1 score 7.5 supplied by GitHub; NVD status Awaiting Analysis | high |
| Outcome | State: averted by disclosure. No exploitation reported in the sources. As of Oct 2026. | assertion | National Vulnerability Database (NVD) record CVE-2026-104850, 'MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server' (CVE numbering authority: GitHub); CVE description and CVSS 3.1 score 7.5 supplied by GitHub; NVD status Awaiting Analysis; GitLab advisory database entry for @modelcontextprotocol/sdk CVE-2026-104850, citing GHSA-6qxp-vccf-f47h, fix commit edd12e2, pull request 2887 and release v2.2.0 | medium |
| Evidence: event | Maintainers' repository advisory GHSA-6qxp-vccf-f47h, published 30 September 2026 and crediting three reporters; GitHub advisory database entry, CVE-2026-104850 record and National Vulnerability Database listing dated 6 October 2026; CVSS (a severity score) version 3.1 base 7.5, High, supplied by GitHub; weaknesses CWE-345 (insufficient verification of data authenticity) and CWE-522 (insufficiently protected credentials) | fact | modelcontextprotocol/typescript-sdk repository security advisory GHSA-6qxp-vccf-f47h: MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server (published by maintainer maxisbey on 30 September 2026, crediting three reporters; full text read as mirrored at api.osv.dev/v1/vulns/GHSA-6qxp-vccf-f47h and in the GitHub advisory database, entry dated 6 October 2026); National Vulnerability Database (NVD) record CVE-2026-104850, 'MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server' (CVE numbering authority: GitHub); CVE description and CVSS 3.1 score 7.5 supplied by GitHub; NVD status Awaiting Analysis; GitLab advisory database entry for @modelcontextprotocol/sdk CVE-2026-104850, citing GHSA-6qxp-vccf-f47h, fix commit edd12e2, pull request 2887 and release v2.2.0 | high |
| Recovery: technical | Patched in @modelcontextprotocol/sdk 1.31.0 and @modelcontextprotocol/client 2.2.0 (and @modelcontextprotocol/core 2.2.0 if imported directly), released 28 September 2026: the client records the authorization server as issuer on saved credentials and does not send them to a different one. Upgrading is not enough for bundled providers (pass expectedIssuer), credentials saved without an issuer (add it or clear them) or custom OAuthClientProvider implementations (persist issuer). Not covered: a new interactive sign-in, direct refreshAuthorization() and exchangeAuthorization() calls, and 2.x with skipIssuerMetadataValidation: true. The advisory says to rotate the client secret or signing key and revoke tokens if an affected client may have connected to an untrusted MCP server. Workarounds: 2.0.0 and 2.1.0 already accept expectedIssuer; on 1.x, connect OAuth-enabled clients only to trusted MCP servers | fact | modelcontextprotocol/typescript-sdk repository security advisory GHSA-6qxp-vccf-f47h: MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server (published by maintainer maxisbey on 30 September 2026, crediting three reporters; full text read as mirrored at api.osv.dev/v1/vulns/GHSA-6qxp-vccf-f47h and in the GitHub advisory database, entry dated 6 October 2026); National Vulnerability Database (NVD) record CVE-2026-104850, 'MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server' (CVE numbering authority: GitHub); CVE description and CVSS 3.1 score 7.5 supplied by GitHub; NVD status Awaiting Analysis; modelcontextprotocol/typescript-sdk on GitHub: commit 51ad4f0, '[v1.x] Bind stored OAuth credentials to the authorization server that issued them (#2888)', 28 September 2026; released as @modelcontextprotocol/sdk 1.31.0, published to npm on 28 September 2026; Release 2.2.0 · modelcontextprotocol/typescript-sdk (tag v2.2.0, 28 September 2026; @modelcontextprotocol/client 2.2.0 published to npm the same day) | high |
| Recovery: accountability | Coordinated disclosure through the maintainers' security advisory, which credits three reporters; the patched releases (28 September 2026) came out two days before the advisory was published (30 September 2026) | fact | modelcontextprotocol/typescript-sdk repository security advisory GHSA-6qxp-vccf-f47h: MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server (published by maintainer maxisbey on 30 September 2026, crediting three reporters; full text read as mirrored at api.osv.dev/v1/vulns/GHSA-6qxp-vccf-f47h and in the GitHub advisory database, entry dated 6 October 2026); modelcontextprotocol/typescript-sdk on GitHub: commit 51ad4f0, '[v1.x] Bind stored OAuth credentials to the authorization server that issued them (#2888)', 28 September 2026; released as @modelcontextprotocol/sdk 1.31.0, published to npm on 28 September 2026; Release 2.2.0 · modelcontextprotocol/typescript-sdk (tag v2.2.0, 28 September 2026; @modelcontextprotocol/client 2.2.0 published to npm the same day) | high |
Controls
| Status | Control | Canonical |
|---|---|---|
| failed | Stored credentials were not bound to the authorization server they belong to | C-A2 Authority binding |
| failed | The client did not verify that the authorization server named in server-supplied metadata was the one the credentials belonged to | C-A1 Actor identity verification |
| succeeded | Coordinated disclosure and fix | C-O1 Coordinated disclosure program |
Inference
inference The record shows that the OAuth client in the Model Context Protocol (MCP) TypeScript software development kit did not tie stored or configured credentials to the authorization server they came from, so an MCP server the client connected to could name a different authorization server and the client would send it those credentials without asking the user. The maintainers' patch records that server as the credentials' issuer and refuses to send them elsewhere, but by the advisory's own account it needs changes beyond upgrading in several setups and does not cover a new interactive sign-in. The record does not show that anyone exploited the flaw, and none of its sources includes a demonstration of an attack.
Sources
| ID | Record | Type | Link |
|---|---|---|---|
| NVD-104850 | National Vulnerability Database (NVD) record CVE-2026-104850, 'MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server' (CVE numbering authority: GitHub); CVE description and CVSS 3.1 score 7.5 supplied by GitHub; NVD status Awaiting Analysis | standards body | nvd.nist.gov ↗ |
| GLAD | GitLab advisory database entry for @modelcontextprotocol/sdk CVE-2026-104850, citing GHSA-6qxp-vccf-f47h, fix commit edd12e2, pull request 2887 and release v2.2.0 | public record | advisories.gitlab.com ↗ |
| GHSA | modelcontextprotocol/typescript-sdk repository security advisory GHSA-6qxp-vccf-f47h: MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server (published by maintainer maxisbey on 30 September 2026, crediting three reporters; full text read as mirrored at api.osv.dev/v1/vulns/GHSA-6qxp-vccf-f47h and in the GitHub advisory database, entry dated 6 October 2026) (interest: maintainers describing their own software) | company primary record | github.com ↗ checked 2026-10-21 |
| FIX-1X | modelcontextprotocol/typescript-sdk on GitHub: commit 51ad4f0, '[v1.x] Bind stored OAuth credentials to the authorization server that issued them (#2888)', 28 September 2026; released as @modelcontextprotocol/sdk 1.31.0, published to npm on 28 September 2026 (interest: maintainers' own repository) | company primary record | github.com ↗ checked 2026-10-21 |
| REL-220 | Release 2.2.0 · modelcontextprotocol/typescript-sdk (tag v2.2.0, 28 September 2026; @modelcontextprotocol/client 2.2.0 published to npm the same day) (interest: maintainers' own repository) | company primary record | github.com ↗ checked 2026-10-21 |