CVE-2026-115563: MCP Python OAuth sends credentials to the wrong issuer

Tracking: CVE-2026-115563
Severity: High; interactive sign-in is scored Medium (CVSS 3.1: 6.5)

Who is affected

Python package mcp 1.9.1 through 1.29.1, and the affected 2.x line from 2.0.0a1 through 2.1.1. The application must use an SDK OAuth handler for an HTTP MCP client and connect to an untrusted server while holding legitimate authorization-server credentials.

How the attack works

Incomplete issuer validation and credential binding let the MCP server select where the client sends OAuth material. An attacker-controlled token endpoint can receive a client secret, authorization code, PKCE verifier, or signed client assertion.

The finding does not affect SDK-built MCP servers, stdio clients, or clients supplying their own tokens or headers.

What to do

1. Upgrade to 1.30.0 or later on 1.x, or 2.2.0 or later on 2.x.
2. Explicitly pass issuer= to ClientCredentialsOAuthProvider or PrivateKeyJWTOAuthProvider. Upgrading without this setting leaves those providers following server-selected authorization servers. Migrate the deprecated RFC7523OAuthClientProvider.
3. Clear stored registrations lacking issuer binding, or bind intentionally pre-registered records. If exposure is possible, rotate client secrets and revoke tokens at the legitimate authorization server.

Scope and limits

Interactive sign-in requires user action; unattended providers have a different risk profile. Warning-only defaults should not be mistaken for enforced issuer binding.

Sources

• Original advisory or incident report