CVE-2026-104850: MCP TypeScript SDK OAuth client could send credentials to an untrusted authorization server
- Product
- @modelcontextprotocol/sdk and @modelcontextprotocol/client (npm)
- CVE
- CVE-2026-104850
- Affected
- @modelcontextprotocol/sdk >= 1.12.0, < 1.31.0; @modelcontextprotocol/client >= 2.0.0, < 2.2.0
- Fixed in
- 1.31.0 / 2.2.0
Last verified against sources: October 16, 2026
Am I affected?
@modelcontextprotocol/sdk and @modelcontextprotocol/client (npm): affected @modelcontextprotocol/sdk >= 1.12.0, < 1.31.0; @modelcontextprotocol/client >= 2.0.0, < 2.2.0. Fixed in 1.31.0 / 2.2.0.
What to do now
- Upgrade to @modelcontextprotocol/sdk 1.31.0 or @modelcontextprotocol/client 2.2.0 or later. [1]
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
What happened
- According to GitHub Advisory Database's advisory (Oct 6, 2026), the SDK's OAuth client let the MCP server decide which authorization server received the client's OAuth credentials. [1]
Impact
- A malicious or compromised MCP server could name its own authorization server, causing the client to send it a stored refresh_token and client_secret with no user interaction. [1]
What was done
- Patched in @modelcontextprotocol/sdk 1.31.0 and @modelcontextprotocol/client 2.2.0. [1]
Sources
- GHSA-6qxp-vccf-f47h — GitHub Advisory Database
Every statement above was checked against these sources before publishing. Spotted an error? Tell us and we will correct it with a dated note.
Share advisory brief with your team
Copy a plain-text summary for Slack, GitHub issues, or team security channels.
[CVE-2026-104850] CVE-2026-104850: MCP TypeScript SDK OAuth client could send credentials to an untrusted authorization server
Product: @modelcontextprotocol/sdk and @modelcontextprotocol/client (npm) | Affected: @modelcontextprotocol/sdk >= 1.12.0, < 1.31.0; @modelcontextprotocol/client >= 2.0.0, < 2.2.0 | Fixed in: 1.31.0 / 2.2.0
Summary: According to GitHub Advisory Database's advisory (Oct 6, 2026), the SDK's OAuth client let the MCP server decide which authorization server received the client's OAuth credentials.
Source & remediation on AgentArmorHQ: https://agentarmorhq.com/incidents/2026/10/cve-2026-104850-mcp-typescript-sdk-oauth-credentialsCorrections
Report an error or request a correction. We review requests within 5 business days and add a dated correction note.
Discussions for CVE-2026-104850
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.