CVE-2026-123272

A flaw was found in mcp-go. A malicious Model Context Protocol MCP server can declare arbitrary protected resources within its metadata due to improper validation in the OAuth metadata handler. This flaw allows an attacker to cause the authorization server to issue tokens scoped for unintended...