> TritonInfoSec News
Home / Sep 30, 2026 / Story
0
#9 The Hacker News general September 29, 2026 at 06:08 UTC

Official MCP Python SDK Flaw Can Let Malicious Servers Steal OAuth Credentials

By [email protected] (The Hacker News)

AI Summary

A vulnerability in the official MCP Python SDK allowed malicious MCP servers to intercept OAuth credentials — including client secrets, authorization codes, and PKCE proof keys — by redirecting token exchange requests to an attacker-controlled endpoint. The flaw was patched in MCP Python SDK version 1.30.0 and later, but any application built on earlier versions that connects to untrusted MCP servers may have been exposed. Given the rapid adoption of MCP-based AI tooling in enterprise environments, developers should audit dependencies and upgrade immediately.

Read full article → https://thehackernews.com/2026/09/official-mcp-pyt…

Relevance score: 75.0/100

# More from September 30

  1. 1
    Hackers exploit Citrix NetScaler zero-day to deploy web shells BleepingComputer
  2. 2
    Apple patches CoreGraphics zero-day flaw exploited in attacks BleepingComputer
  3. 3
    New Spectre v2 attack variant leaks Linux root password hash in minutes BleepingComputer
  4. 4
    French Tax Data Theft Using Stolen Staff Passwords Went Undetected for Seven Weeks The Hacker News
  5. 5
    Russia's Star Blizzard Targets 100+ Organizations With Fake Event Invites to Deliver Backdoor The Hacker News
  6. 6
    FBI tells ShinyHunters members to turn themselves in after recent arrest BleepingComputer
  7. 7
    Pentagon Personnel Agency Data Breach Impacts 3 Million People SecurityWeek
  8. 8
    JadePuffer agentic AI attacks target Azure, destroy cloud resources BleepingComputer
  9. 10
    Misconfigured Supabase apps expose data in over 16,000 databases BleepingComputer