MCP kits could send login secrets to an attacker

In April 2026, a researcher sent a report about two vulnerabilities in the official kits for Python and TypeScript. The kits help AI tools connect to other software with MCP, the Model Context Protocol. A bad MCP server could make a kit send login secrets to an attacker. The CVSS rating of each vulnerability is 7.5 (High) of 10. Patches are available.

How it works

A remote MCP server can tell the client which authorization server to use. That server gives login tokens. The kits did not check that the secrets are for the server that the MCP server selected. A bad server could select an endpoint that it controls and get the secrets.

In some setups, these items could go to the attacker:

• OAuth client secrets
• refresh tokens
• authorization codes
• PKCE verifiers
• signed client assertions

The numbers

The CVSS rating of each vulnerability is 7.5 of 10. The researcher examined the code in Python kit version 1.29.1. The researcher tells that the example documents are examples only. The researcher gives no report of attacks in use.

What is not known

The advisories tell that an upgrade is not sufficient for some configurations. The configurations are not given. The patch version numbers are not given.

Insight: Three MCP vulnerabilities share one missing check on who owns a credential

On 8 October 2026, Cycode found that a bad MCP server could steal OAuth secrets from the Python kit. On 27 October 2026, AWS repaired an MCP server that accepted a token made for a different app. Each time, the code confirmed a credential but not its owner, and the other side can use it. This seems to be a missing check between the standard and each builder. Test this check in each MCP client and server.