AIKIDO-2026-10997

TL;DR

The OAuth client in @ai-sdk/mcp generates a state parameter and forwards it to the authorization server, but never validates the value returned to the callback before exchanging the authorization code for tokens. An attacker can initiate their own OAuth flow against the MCP server, then trick a victim into visiting a crafted callback URL carrying the attacker's authorization code. The fix adds saveState and storedState hooks to the OAuthClientProvider interface, requires callers to forward the received state through callbackState, and rejects the token exchange with an OAuth state parameter mismatch error when the values do not match.