CVE-2026-104850 · GHSA-6qxp-vccf-f47h

MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server

Risk score: 56/100
CVSS: 7.5 v3.1
Exploit chance (30 days): 0.2%
Published: 6 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Starting in version 1.12.0 and prior to versions 1.31.0 and 2.2.0, the SDK's OAuth client support let the MCP server a client connected to decide which authorization server received the client's OAuth credentials. Stored …
Affected: @modelcontextprotocol/sdk (npm) >= 1.12.0, < 1.31.0; @modelcontextprotocol/client (npm) >= 2.0.0, < 2.2.0
Fix: Upgrade @modelcontextprotocol/sdk to 1.31.0; @modelcontextprotocol/client to 2.2.0 or later.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

@modelcontextprotocol/sdk: Amber, patch this week. The MCP TypeScript SDK's experimental tasks feature did not check which session created a task, allowing clients to list, read, and cancel each other's tasks. An attacker could exploit this vulnerability to gain control over other clients' tasks.

The flaws

CVE-2026-104850: MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server (CVSS 7.5 · EPSS 0%)
CVE-2026-111767: MCP TypeScript SDK: Experimental tasks were not tied to the session that created them (CVSS 8.6 · EPSS 0%)
CVE-2026-111768: MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation (CVSS 7.5)
CVE-2026-111771: MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service (CVSS 6.8)

The fix

Upgrade @modelcontextprotocol/sdk: 1.31.0 · 2.2.0 · 1.32.0 or later on your release line

Who is exposed: {'products': ['MCP TypeScript SDK'], 'packages': [{'ecosystem': 'npm', 'name': '@modelcontextprotocol/sdk', 'vulnerable': '>= 1.24.0, < 1.32.0', 'patched': '1.32.0'}], 'versions': ['1.24.0 to 1.32.0 (exclusive)', '1.32.0']}

Where it stands

No known exploitation

Connects to

Same weakness: CWE-345 (CWE-345). 45 other warnings in 30 days

Why it is Yellow

CVSS 7.5 high
Remotely exploitable without logging in
On your watchlist: npm

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
@modelcontextprotocol/sdk	npm	>= 1.12.0, < 1.31.0	1.31.0
@modelcontextprotocol/client	npm	>= 2.0.0, < 2.2.0	2.2.0

References

Original description

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Starting in version 1.12.0 and prior to versions 1.31.0 and 2.2.0, the SDK's OAuth client support let the MCP server a client connected to decide which authorization server received the client's OAuth credentials. Stored and pre-provisioned credentials were not bound to the authorization server they belong to. A malicious or compromised MCP server could name its own authorization server in its protected resource metadata. Without any user interaction, the client would send that server the `refresh_token` and `client_secret` stored from an earlier sign-in (1.x), or the configured `client_secret` or signed assertion of a bundled non-interactive provider (1.x and 2.x). Only those applications that use the SDK as an MCP client over HTTP with an `authProvider`: your own `OAuthClientProvider`, or the bundled `ClientCredentialsProvider`, `PrivateKeyJwtProvider`, `StaticPrivateKeyJwtProvider` or (2.x) `CrossAppAccessProvider` and that may connect to an MCP server the owners does not fully trust while holding credentials for a legitimate authorization server are affected. `@modelcontextprotocol/sdk` 1.31.0 (1.x) and `@modelcontextprotocol/client` 2.2.0 (2.x) patch the issue. A workaround for those who cannot upgrade is available. 2.0.0 and 2.1.0 already accept `expectedIssuer`. On 1.x, the only workaround is to connect OAuth-enabled clients only to MCP servers you trust.

Last activity 6 Oct 2026. Patch Forecast updates every hour.