CVE-2026-111769

A flaw was found in the Model Context Protocol MCP TypeScript SDK. The HTTP client transports and OAuth client mechanisms follow cross-origin redirects without stripping custom request headers or request bodies. A malicious or compromised server could redirect client requests to an untrusted...