Open Redirect Affecting @modelcontextprotocol/sdk package, versions <1.32.0

@modelcontextprotocol/sdk is a Model Context Protocol implementation for TypeScript

Affected versions of this package are vulnerable to Open Redirect via unconstrained redirect-following in the HTTP fetch layer used by auth.ts, sse.ts, and streamableHttp.ts. When the client performs OAuth metadata discovery, token requests, or client registration, it follows HTTP redirects without verifying that the redirect destination remains within the original request's origin. An attacker who can interpose a redirect response (for example, through a compromised or malicious server) can cause the client to send authentication credentials, OAuth tokens, or other sensitive headers to an attacker-controlled origin, resulting in credential exfiltration and limited request forgery.

• GitHub Advisory
• GitHub Commit
• GitHub Commit
• GitHub PR
• GitHub PR