Official MCP Python SDK Flaw Exposes AI Agent OAuth Credentials to Malicious Servers

The official Model Context Protocol (MCP) Python SDK contains a flaw that allows malicious servers to steal OAuth credentials, including the client secret, authorization code, and PKCE proof key. Security firm Cycode demonstrated that the stolen credentials can be used to request valid access tokens with the exact same permissions granted to the original application. The vulnerability carries a high severity score of 7.5 for automated machine-to-machine setups, dropping slightly to 6.5 for interactive sign-ins where a user must manually approve the login page. Maintainers released fixes in versions 1.30.0 and 2.2.0, which now force the client to verify the expected login service before fetching any details. For developers using certain OAuth providers, simply upgrading the package offers zero protection unless they also manually pass the "issuer=" parameter to explicitly name the login service.