PT-2026-135862

Maintainer assessment and remediation This report is accepted as a FastMCP credential-binding vulnerability. Affected versions of the OAuth client credentials providers do not expose the authorization-server issuer that owns pre-registered credentials. An untrusted or compromised MCP server can...

Insufficient Verification of Data Authenticity

Overview mcp is a Model Context Protocol SDK Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in OAuthClientProvider, ClientCredentialsOAuthProvider, PrivateKeyJWTOAuthProvider, and the deprecated 1.x RFC7523OAuthClientProvider, which accept the...