{
  "entry": {
    "kind": "vuln",
    "slug": "cve-2026-104850",
    "name": "CVE-2026-104850",
    "vendor": "@modelcontextprotocol/sdk",
    "description": "The Model Context Protocol maintainers published GHSA-6qxp-vccf-f47h for the official TypeScript SDK on 30 September 2026; it was assigned CVE-2026-104850 (CVSS 3.1 7.5) and added to the GitHub Advisory Database and NVD on 6 October. The SDK's OAuth client let the MCP server it connected to decide which authorization server received the client's credentials, because stored and pre-provisioned credentials were not bound to the authorization server they belong to. A malicious or compromised MCP server could name its own authorization server and, with no user interaction, receive the refresh_token and client_secret stored from an earlier sign-in, or the client_secret or signed assertion of a bundled non-interactive provider. Affected: @modelcontextprotocol/sdk 1.12.0 through 1.30.1 (fixed in 1.31.0, released 28 September) and @modelcontextprotocol/client 2.0.0 through 2.1.x in specific cases (fixed in 2.2.0). Only HTTP clients using an authProvider, withOAuth() or direct auth()/fetchToken() are affected; MCP servers built with the SDK and stdio clients are not. It is the TypeScript counterpart of Python GHSA-qx49-fqc8-xw99 (see the MCP reference SDK advisories entry, also written up by Cycode), and unlike that one it is visible to npm dependency scanners. The fix does not cover a new interactive sign-in to a server-named authorization server, or direct calls to refreshAuthorization() and exchangeAuthorization(). No exploitation has been reported.",
    "website": "https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-6qxp-vccf-f47h",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": {
      "manager": "npm",
      "packageName": "@modelcontextprotocol/sdk",
      "command": null
    },
    "configFiles": null,
    "category": "mcp-server",
    "updatedAt": "2026-09-30",
    "risk": {
      "score": 75,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "CVE-2026-104850",
      "aliases": [
        "ti-127",
        "GHSA-6qxp-vccf-f47h"
      ],
      "title": "CVE-2026-104850: MCP TypeScript SDK Let a Malicious MCP Server Name Its Own Authorization Server and Receive Stored Refresh Tokens and Client Secrets (CVSS 7.5)",
      "summary": "The Model Context Protocol maintainers published GHSA-6qxp-vccf-f47h for the official TypeScript SDK on 30 September 2026; it was assigned CVE-2026-104850 (CVSS 3.1 7.5) and added to the GitHub Advisory Database and NVD on 6 October. The SDK's OAuth client let the MCP server it connected to decide which authorization server received the client's credentials, because stored and pre-provisioned credentials were not bound to the authorization server they belong to. A malicious or compromised MCP server could name its own authorization server and, with no user interaction, receive the refresh_token and client_secret stored from an earlier sign-in, or the client_secret or signed assertion of a bundled non-interactive provider. Affected: @modelcontextprotocol/sdk 1.12.0 through 1.30.1 (fixed in 1.31.0, released 28 September) and @modelcontextprotocol/client 2.0.0 through 2.1.x in specific cases (fixed in 2.2.0). Only HTTP clients using an authProvider, withOAuth() or direct auth()/fetchToken() are affected; MCP servers built with the SDK and stdio clients are not. It is the TypeScript counterpart of Python GHSA-qx49-fqc8-xw99 (see the MCP reference SDK advisories entry, also written up by Cycode), and unlike that one it is visible to npm dependency scanners. The fix does not cover a new interactive sign-in to a server-named authorization server, or direct calls to refreshAuthorization() and exchangeAuthorization(). No exploitation has been reported.",
      "severity": "high",
      "cvss": {
        "score": 7.5,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Credential theft"
      ],
      "componentType": "mcp-server",
      "component": {
        "name": "@modelcontextprotocol/sdk",
        "vendor": null,
        "package": "@modelcontextprotocol/sdk",
        "ecosystem": "npm",
        "catalogSlug": null
      },
      "affected": [
        {
          "range": ">=1.12.0 <1.31.0",
          "fixed": "1.31.0"
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-09-30",
      "modifiedAt": "2026-09-30",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "advisory",
          "url": "https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-6qxp-vccf-f47h"
        },
        {
          "type": "cve",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104850"
        }
      ],
      "mitigation": "Upgrade @modelcontextprotocol/sdk to 1.31.0+, or @modelcontextprotocol/client and core to 2.2.0+. Upgrading alone is not enough in three cases: bundled providers (ClientCredentialsProvider, PrivateKeyJwtProvider, StaticPrivateKeyJwtProvider, CrossAppAccessProvider) must be given an explicit expectedIssuer; credentials saved before the upgrade carry no issuer and must be tagged or cleared so users sign in again; and custom OAuthClientProvider implementations must persist the issuer passed to saveTokens() and saveClientInformation(). If an affected client may have connected to an untrusted MCP server, rotate its client secret or signing key and revoke its tokens. Until patched, connect OAuth-enabled clients only to MCP servers you trust.",
      "detectedByAnomity": true
    }
  }
}