MCP TypeScript SDK OAuth client could send credentials to an authorization server chosen by the MCP server
- Product
- MCP TypeScript SDK (@modelcontextprotocol/sdk and @modelcontextprotocol/client)
- CVE
- CVE-2026-104850
- Affected
- @modelcontextprotocol/sdk 1.12.0 through 1.30.1; @modelcontextprotocol/client 2.0.0 through 2.1.0
- Fixed in
- @modelcontextprotocol/sdk 1.31.0; @modelcontextprotocol/client 2.2.0
Last verified against sources: October 26, 2026
Am I affected?
MCP TypeScript SDK (@modelcontextprotocol/sdk and @modelcontextprotocol/client): affected @modelcontextprotocol/sdk 1.12.0 through 1.30.1; @modelcontextprotocol/client 2.0.0 through 2.1.0. Fixed in @modelcontextprotocol/sdk 1.31.0; @modelcontextprotocol/client 2.2.0.
- Check your version: run
npm ls @modelcontextprotocol/sdk. Versions >= 1.12.0, < 1.31.0 of @modelcontextprotocol/sdk are affected. [1] - Check your version: run
npm ls @modelcontextprotocol/client. Versions >= 2.0.0, < 2.2.0 of @modelcontextprotocol/client are affected. [1]
What to do now
- Upgrade to the fixed version: run
npm install @modelcontextprotocol/sdk@1.31.0(first patched version 1.31.0). [1] - Upgrade to the fixed version: run
npm install @modelcontextprotocol/client@2.2.0(first patched version 2.2.0). [1] - Upgrade to @modelcontextprotocol/sdk 1.31.0 or later, or @modelcontextprotocol/client 2.2.0 or later, and @modelcontextprotocol/core 2.2.0 or later if you import it directly. [1]
- Pass expectedIssuer to bundled providers, for example expectedIssuer: 'https://auth.example.com'. [1]
- Add issuer to credentials saved without it, or clear them so users sign in again. [1]
- If an affected client may have connected to an untrusted MCP server, rotate its client secret or signing key and revoke its tokens. [1]
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
What happened
- The SDK's OAuth client let the MCP server decide which authorization server received the client's OAuth credentials. [1]
- The credentials were not tied to the authorization server they belong to. [1]
- A malicious or compromised MCP server could name its own authorization server. [1]
- The client sent the credentials with no user interaction. [1]
Impact
What was done
Sources
- GHSA-6qxp-vccf-f47h — GitHub Advisory Database
Every statement above was checked against these sources before publishing. Spotted an error? Tell us and we will correct it with a dated note.
Share advisory brief with your team
Copy a plain-text summary for Slack, GitHub issues, or team security channels.
[CVE-2026-104850] MCP TypeScript SDK OAuth client could send credentials to an authorization server chosen by the MCP server
Product: MCP TypeScript SDK (@modelcontextprotocol/sdk and @modelcontextprotocol/client) | Affected: @modelcontextprotocol/sdk 1.12.0 through 1.30.1; @modelcontextprotocol/client 2.0.0 through 2.1.0 | Fixed in: @modelcontextprotocol/sdk 1.31.0; @modelcontextprotocol/client 2.2.0
Summary: The SDK's OAuth client let the MCP server decide which authorization server received the client's OAuth credentials.
Source & remediation on AgentArmorHQ: https://agentarmorhq.com/incidents/2026/10/cve-2026-104850-mcp-typescript-sdk-modelcontextprotocol-sdk-and-modelcontextprotocol-clientCorrections
Report an error or request a correction. We review requests within 5 business days and add a dated correction note.
Discussions for CVE-2026-104850
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.