Official MCP Python SDK Flaw Can Let Malicious Servers Steal OAuth Credentials
Malicious MCP servers could steal OAuth client secrets and PKCE keys from apps using the official Python SDK; fixed in 1.30.0 and 2.2.0.
Stories per day · 30 days
4 RSS
2 stories, newest first · one card per story
Stories tagged #pkce
CVE-2026-92289: Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKCE or secret" mode because checkEndPointAuthenticationCredentials does not verify the client secret
CVE-2026-92289 lets LemonLDAP::NG public OAuth clients bypass PKCE because client secrets are not verified.