CVE-2026-123272

Mark3labs mcp-go before v1.2.1 contains an improper validation vulnerability in OAuthHandler.fetchServerMetadata that allows malicious MCP servers to obtain tokens for other resources by declaring arbitrary resources in well-known metadata. Attackers can declare a different MCP server as the RFC...

CVE-2026-123272 mcp-go before v1.2.1 Origin Validation Error via Unvalidated Well-Known Protected Resource Metadata

Mark3labs mcp-go before v1.2.1 contains an improper validation vulnerability in OAuthHandler.fetchServerMetadata that allows malicious MCP servers to obtain tokens for other resources by declaring arbitrary resources in well-known metadata. Attackers can declare a different MCP server as the RFC...

CVE-2026-123272

The Mark3labs mcp-go library (versions before v1.2.1 ) is vulnerable to an improper validation vulnerability within the OAuthHandler.fetchServerMetadata function. An attacker can exploit this by declaring arbitrary resources in well-known metadata , specifically by using a different MCP server as...

EUVD-2026-117725

Mark3labs mcp-go before v1.2.1 contains an improper validation vulnerability in OAuthHandler.fetchServerMetadata that allows malicious MCP servers to obtain tokens for other resources by declaring arbitrary resources in well-known metadata. Attackers can declare a different MCP server as the RFC...