Insufficient Verification of Data Authenticity Affecting mcp package, versions [,1.30.0)[2.0.0a1,2.2.0)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-MCP-20417226
- published4 Oct 2026
- disclosed28 Sept 2026
- creditAviral Srivastava, Alex Melan, Ali Sadeghi, Maryam Rostamipoor, Yuval Elbar, Roni Gurvich, Mahmoud Albustan
Introduced: 28 Sep 2026
New CVE NOT AVAILABLE CWE-345 (opens in a new tab)How to fix?
Upgrade mcp to version 1.30.0, 2.2.0 or higher.
Overview
mcp is a Model Context Protocol SDK
Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in OAuthClientProvider, ClientCredentialsOAuthProvider, PrivateKeyJWTOAuthProvider, and the deprecated 1.x RFC7523OAuthClientProvider, which accept the authorization server metadata an MCP server supplies without validating the issuer field and without binding stored credentials to a particular authorization server. An attacker operating an MCP server can collect the client's client_secret, authorization code, and PKCE code_verifier, by advertising metadata whose token endpoint points at a server they control, which the client then contacts using credentials it holds for a legitimate authorization server. This requires an application using the SDK as an MCP client over HTTP with one of those providers and connecting to a server the attacker controls while holding credentials, and PKCE provides no protection in this case, since the code_verifier is sent to the attacker's endpoint along with everything else.