CVE-2026-104850

The MCP TypeScript SDK (versions 1.12.0 through 1.30.1) and @modelcontextprotocol/client (versions 2.0.0 through 2.1.0) are vulnerable to a flaw where the SDK's OAuth client allows a connected MCP server to dictate which authorization server receives client credentials. Because credentials were n...