AIKIDO-2026-821108
mcp is vulnerable to Insufficiently Protected Credentials
75
High Risk
This Affects:
mcpTL;DR
The OAuth client support in mcp.client.auth does not validate the authorization server metadata issuer on every discovery path and does not bind stored or pre-provisioned client credentials to a specific authorization server. A connected MCP server can name its own token endpoint, or present itself as the user's real authorization server, and receive the client's client_secret, authorization code, and PKCE code_verifier, or a signed client assertion. The fix validates the issuer on every discovery path and binds credentials to the authorization server they belong to.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use the SDK as an MCP client with OAuth support (OAuthClientProvider, ClientCredentialsOAuthProvider, PrivateKeyJWTOAuthProvider, or the deprecated RFC7523OAuthClientProvider) while holding credentials for a legitimate authorization server.
Background info
mcp is vulnerable to Insufficiently Protected Credentials in versions 1.9.1 - 1.29.1 and 2.0.0 - 2.1.1.
How to fix this
Upgrade the mcp library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.