Cyber AI Digest
  1. Sebastien Gioria Oct 20, 2026
    Synapse Halo mascot - Vulnerability

    Vulnerability

    The official MCP TypeScript SDK lets a malicious MCP server designate the authorization server that receives OAuth secrets.

    • The CVE-2026-104850 flaw has a CVSS score of 7.5 and requires no user interaction.

    • The refresh_token and client_secret of a previous connection can leak in 1.x.

    • The fixes are in @modelcontextprotocol/sdk 1.31.0 and @modelcontextprotocol/client 2.2.0.

    • According to the author, the update alone is not enough: expectedIssuer must also be passed to the provided providers.

    Read the original article MCP TypeScript SDK : c'est le serveur MCP qui choisissait à qui envoyer vos secrets OAuth blog.gioria.org

Back to the weekBack to the month