AIKIDO-2026-260859

TL;DR

The OAuth client validates a server-controlled resource_metadata URL taken from the WWW-Authenticate header using a check that only enforces the HTTPS scheme. Because the check does not restrict private, loopback, link-local, or cloud-metadata destinations and reads only the dotted-decimal form of an address, a malicious or compromised MCP server can point discovery at internal HTTPS services or the cloud metadata endpoint. The client issues the request automatically during OAuth discovery from its own network position, before any user approval, resulting in blind server-side request forgery. The fix restricts discovery destinations to same-origin, routable hosts and rejects private and metadata addresses including alternate numeric spellings.