PT-2026-106775

Name of the Vulnerable Software and Affected Versions @modelcontextprotocol/sdk versions 1.12.0 through 1.30.1 @modelcontextprotocol/client versions 2.0.0 through 2.1.0 Description The SDK's OAuth client support allows an MCP server to determine which authorization server receives the client's...

12306-adk-mcp (0.3.4), 12306-mcp (>=0.3.3, <=0.3.10) +1801 more potentially affected by CVE-2026-25536 via @modelcontextprotocol/sdk (>=1.10.0, <=1.25.3)

@modelcontextprotocol/sdk NPM version =1.10.0, =0.3.3, =1.0.0, =1.14.1, =1.0.0, =1.2.1, =0.1.4, =0.0.1, =0.0.1, =1.0.0, =1.1.0, =1.0.0, =1.0.0, =10.1.0-rc.1, =10.2.1 and more Source cves: CVE-2026-25536 Source advisory: SNYK:JS-MODELCONTEXTPROTOCOLSDK-15208843...

12306-adk-mcp (0.3.4), 12306-mcp (>=0.3.3, <=0.3.10) +1801 more potentially affected by CVE-2026-25536 via @modelcontextprotocol/sdk (>=1.10.0, <=1.25.3)

@modelcontextprotocol/sdk NPM version =1.10.0, =0.3.3, =1.0.0, =1.14.1, =1.0.0, =1.2.1, =0.1.4, =0.0.1, =0.0.1, =1.0.0, =1.1.0, =1.0.0, =1.0.0, =10.1.0-rc.1, =10.2.1 and more Source cves: CVE-2026-25536 Source advisory: OSV:GHSA-345P-7CG4-V4C7...

12306-adk-mcp (0.3.4), 12306-mcp (>=0.3.3, <=0.3.10) +2044 more potentially affected by CVE-2026-0621 via @modelcontextprotocol/sdk (>=1.3.0, <=1.25.1)

@modelcontextprotocol/sdk NPM version =1.3.0, =0.3.3, =1.0.0, =0.1.0, =1.14.1, =0.1.0, =1.0.0, =1.2.1, =0.1.4, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.1, =0.0.1, =1.0.0, =2.4.0 and more Source cves: CVE-2026-0621 Source advisory: SNYK:JS-MODELCONTEXTPROTOCOLSDK-14871802...

12306-adk-mcp (0.3.4), 12306-mcp (>=0.3.3, <=0.3.10) +2044 more potentially affected by CVE-2026-0621 via @modelcontextprotocol/sdk (>=1.3.0, <=1.25.1)

@modelcontextprotocol/sdk NPM version =1.3.0, =0.3.3, =1.0.0, =0.1.0, =1.14.1, =0.1.0, =1.0.0, =1.2.1, =0.1.4, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.1, =0.0.1, =1.0.0, =2.4.0 and more Source cves: CVE-2026-0621 Source advisory: OSV:GHSA-8R9Q-7V3J-JR4G...

12306-adk-mcp (0.3.4), 12306-mcp (>=0.3.3, <=0.3.10) +2590 more potentially affected by CVE-2025-66414 via @modelcontextprotocol/sdk (>=1.0.0, <=1.23.1)

@modelcontextprotocol/sdk NPM version =1.0.0, =0.3.3, =1.0.0, =0.1.0, =1.14.1, =0.1.0, =1.0.0, =1.2.1, =0.1.4, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.1, =0.0.1, =1.0.0, =2.4.0 and more Source cves: CVE-2025-66414 Source advisory: OSV:GHSA-W48Q-CV73-MX4W...

12306-adk-mcp (0.3.4), 12306-mcp (>=0.3.3, <=0.3.10) +2590 more potentially affected by CVE-2025-66414 via @modelcontextprotocol/sdk (>=1.0.0, <=1.23.1)

@modelcontextprotocol/sdk NPM version =1.0.0, =0.3.3, =1.0.0, =0.1.0, =1.14.1, =0.1.0, =1.0.0, =1.2.1, =0.1.4, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.1, =0.0.1, =1.0.0, =2.4.0 and more Source cves: CVE-2025-66414 Source advisory: SNYK:JS-MODELCONTEXTPROTOCOLSDK-14171914...