@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.26), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.26) potentially affected by CVE-2026-105845 via payload (>=4.0.0-canary.0, <=4.0.0-canary.26)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.26 Source cves: CVE-2026-105845 Source advisory: GHSA-V49J-62M6-PGRR...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.26), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.26) potentially affected by CVE-2026-105845 via payload (>=4.0.0-canary.0, <=4.0.0-canary.26)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.26 Source cves: CVE-2026-105845 Source advisory: OSV:GHSA-V49J-62M6-PGRR...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.26), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.26) potentially affected by CVE-2026-105845 via payload (>=4.0.0-canary.0, <=4.0.0-canary.26)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.26 Source cves: CVE-2026-105845 Source advisory: SNYK:JS-PAYLOAD-20571753...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.26), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.26) potentially affected by CVE-2026-105846 via payload (>=4.0.0-canary.0, <=4.0.0-canary.26)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.26 Source cves: CVE-2026-105846 Source advisory: OSV:GHSA-W84C-53H3-MC2G...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.26), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.26) potentially affected by CVE-2026-105846 via payload (>=4.0.0-canary.0, <=4.0.0-canary.26)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.26 Source cves: CVE-2026-105846 Source advisory: GHSA-W84C-53H3-MC2G...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.26), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.26) potentially affected by CVE-2026-105846 via payload (>=4.0.0-canary.0, <=4.0.0-canary.26)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.26 Source cves: CVE-2026-105846 Source advisory: SNYK:JS-PAYLOAD-20571762...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.33) potentially affected by CVE-2026-105847 via payload (>=4.0.0-canary.0, <=4.0.0-canary.33)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105847 Source advisory: OSV:GHSA-FPWW-C55P-CJV6...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.33) potentially affected by CVE-2026-105847 via payload (>=4.0.0-canary.0, <=4.0.0-canary.33)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105847 Source advisory: SNYK:JS-PAYLOAD-20571409...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.33) potentially affected by CVE-2026-105847 via payload (>=4.0.0-canary.0, <=4.0.0-canary.33)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105847 Source advisory: GHSA-FPWW-C55P-CJV6...

CVE-2026-104850 MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Starting in version 1.12.0 and prior to versions 1.31.0 and 2.2.0, the SDK's OAuth client support let the MCP server a client connected to decide which authorization server received the client's OAut...

CVE-2026-104850

The MCP TypeScript SDK (versions 1.12.0 through 1.30.1) and @modelcontextprotocol/client (versions 2.0.0 through 2.1.0) are vulnerable to a flaw where the SDK's OAuth client allows a connected MCP server to dictate which authorization server receives client credentials. Because credentials were n...

EUVD-2026-93491

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Starting in version 1.12.0 and prior to versions 1.31.0 and 2.2.0, the SDK's OAuth client support let the MCP server a client connected to decide which authorization server received the client's OAut...

CVE-2026-104850 MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Starting in version 1.12.0 and prior to versions 1.31.0 and 2.2.0, the SDK's OAuth client support let the MCP server a client connected to decide which authorization server received the client's OAut...

CVE-2026-104850 MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Starting in version 1.12.0 and prior to versions 1.31.0 and 2.2.0, the SDK's OAuth client support let the MCP server a client connected to decide which authorization server received the client's OAut...

12306-adk-mcp (0.3.4), 12306-mcp (>=0.3.3, <=0.3.10) +5685 more potentially affected by CVE-2026-104850 via @modelcontextprotocol/sdk (>=1.12.0, <=1.30.1)

@modelcontextprotocol/sdk NPM version =1.12.0, =0.3.3, =1.0.0, =0.2.0, =1.14.1, =1.0.0, =0.1.3, =0.1.8, =0.1.0, =0.2.0, =0.38.0, =1.0.0, =8.0.0, =0.1.0, =0.1.2 and more Source cves: CVE-2026-104850 Source advisory: MEND:CVE-2026-104850...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.33) potentially affected by CVE-2026-105847 via payload (>=4.0.0-canary.0, <=4.0.0-canary.33)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105847 Source advisory: MEND:CVE-2026-105847...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.26), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.26) potentially affected by CVE-2026-105846 via payload (>=4.0.0-canary.0, <=4.0.0-canary.26)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.26 Source cves: CVE-2026-105846 Source advisory: MEND:CVE-2026-105846...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.26), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.26) potentially affected by CVE-2026-105845 via payload (>=4.0.0-canary.0, <=4.0.0-canary.26)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.26 Source cves: CVE-2026-105845 Source advisory: MEND:CVE-2026-105845...

@01.software/cli (>=0.1.1, <=0.2.0), @01.software/sdk (>=0.0.1-251008.90016, <=0.3.0) +32 more potentially affected by CVE-2026-105804 via payload (>=3.0.1, <=3.89.0)

payload NPM version =3.0.1, =0.1.1, =0.0.1-251008.90016, =0.0.6, =0.0.25, =1.0.1-beta.0, =0.21.0, =0.14.0, =0.21.0, =0.21.0, =1.0.0, =0.1.0, =3.1.0-types, =3.1.0 - @otherdev-software/canvas 1.0.0 and more Source cves: CVE-2026-105804 Source advisory: SNYK:JS-PAYLOAD-20571528...

@payloadcms/plugin-redirects (>=4.0.0-canary.0, <=4.0.0-canary.33), @payloadcms/sdk (>=4.0.0-canary.0, <=4.0.0-canary.33) potentially affected by CVE-2026-105804 via payload (>=4.0.0-canary.0, <=4.0.0-canary.33)

payload NPM version =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.0, =4.0.0-canary.33 Source cves: CVE-2026-105804 Source advisory: OSV:GHSA-Q6MQ-CH85-C8MM...