MCP TypeScript SDK OAuth client could send credentials to a server-chosen auth server

What's on the official record

The OSV advisory GHSA-6qxp-vccf-f47h, published 6 October 2026, reports a HIGH-severity vulnerability in the npm package @modelcontextprotocol/sdk (MCP TypeScript SDK, mcp layer), aliased CVE-2026-104850 and classified under CWE-345 and CWE-522. The advisory states that in affected versions the SDK's OAuth client let the MCP server decide which authorization server received the client's OAuth credentials, and that credentials were not tied to the authorization server they belong to. A malicious or compromised MCP server could name its own authorization server. The advisory names fixed version 1.31.0 and does not enumerate specific affected versions.

Assessment

For a platform or AI-stack owner, the record lets you check the pinned version of @modelcontextprotocol/sdk in any MCP server you run, and pull or patch any deployment below 1.31.0. The advisory states the OAuth client did not tie credentials to the authorization server they belong to, so the record supports checking whether any MCP server in your stack can name the authorization server that receives OAuth credentials.

For a deal team, the record lets you scope diligence on any target that ships or embeds the MCP TypeScript SDK below 1.31.0. The advisory reports a HIGH-severity credential-exposure condition fixed in 1.31.0, so the record supports asking whether a target's MCP server deployments pin a version below the fix.

What would change this call

A revised advisory that enumerates affected versions, or a statement that a given deployment's OAuth client is not reachable, would narrow the exposure.

What to check next

Confidence

Filed 25 October 2026 from the record dated 6 October 2026. The note is drawn from a single OSV advisory row; the severity, fixed version, and CWE classifications are as the advisory states them.

Sources

[1] MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server — https://github.com/advisories/GHSA-6qxp-vccf-f47h