CVE-2026-104850

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Starting in version 1.12.0 and prior to versions 1.31.0 and 2.2.0, the SDK's OAuth client support let the MCP server a client connected to decide which authorization server received the client's OAuth credentials. Stored and pre-provisioned credentials were not bound to the authorization server they belong to. A malicious or compromised MCP server could name its own authorization server in its protected resource metadata. Without any user interaction, the client would send that server the `refresh_token` and `client_secret` stored from an earlier sign-in (1.x), or the configured `client_secret` or signed assertion of a bundled non-interactive provider (1.x and 2.x). Only those applications that use the SDK as an MCP client over HTTP with an `authProvider`: your own `OAuthClientProvider`, or the bundled `ClientCredentialsProvider`, `PrivateKeyJwtProvider`, `StaticPrivateKeyJwtProvider` or (2.x) `CrossAppAccessProvider` and that may connect to an MCP server the owners does not fully trust while holding credentials for a legitimate authorization server are affected. `@modelcontextprotocol/sdk` 1.31.0 (1.x) and `@modelcontextprotocol/client` 2.2.0 (2.x) patch the issue. A workaround for those who cannot upgrade is available. 2.0.0 and 2.1.0 already accept `expectedIssuer`. On 1.x, the only workaround is to connect OAuth-enabled clients only to MCP servers you trust.

• CWE-345
• CWE-522

• https://github.com/modelcontextprotocol/typescript-sdk/commit/edd12e282620ebf770d67316f19cf91d4112a1bd
• https://github.com/modelcontextprotocol/typescript-sdk/pull/2887
• https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.2.0
• https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-6qxp-vccf-f47h

Published

Oct 6, 2026

Last Modified

Oct 6, 2026

Status

Awaiting Analysis

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-104844PostCSS Selector Parser is a CSS selector parser that integr…5.9
• CVE-2026-104845Seroval facilitates JS value stringification, including comp…7.5
• CVE-2026-104846Seroval facilitates JS value stringification, including comp…9.8
• CVE-2026-104847ProseMirror's view component renders and manages the editabl…8.5
• CVE-2026-104848Tinypool is a minimal Node.js worker thread pool implementat…9.5
• CVE-2026-104849Tinypool is a minimal Node.js worker thread pool implementat…9.5
• CVE-2026-104851fsspec is a specification and Python implementation framewor…8.8
• CVE-2026-104852GraphQL Tools provides utilities for building, stitching, an…8.2
• CVE-2026-104853Nx is a monorepo solution for TypeScript and polyglot codeba…5.8
• CVE-2026-104854Nx is a monorepo solution for TypeScript and polyglot codeba…8.5
• CVE-2026-104855Wasmtime is a runtime for WebAssembly. From 46.0.0 until 46.…2
• CVE-2026-104859Nx is a monorepo solution for TypeScript and polyglot codeba…7.3