CVE-2026-108716

The mcp-remote library, versions 0.8.0 through 0.14.3 , is vulnerable to a cleartext transmission flaw within the authorizeWithDeviceCode function. The root cause is the failure to enforce HTTPS endpoints when handling device authorization and token endpoints. If these endpoints are non-loopback ...

CVE-2026-108716 mcp-remote 0.8.0 through 0.14.3 Cleartext Credential Transmission via --device-code OAuth Grant

mcp-remote 0.8.0 through 0.14.3 contains a cleartext transmission vulnerability in authorizeWithDeviceCode that sends client secrets and receives tokens without enforcing HTTPS endpoints. When discovered device authorization and token endpoints are non-loopback http URLs, on-path network attacker...

EUVD-2026-96990

mcp-remote 0.8.0 through 0.14.3 contains a cleartext transmission vulnerability in authorizeWithDeviceCode that sends client secrets and receives tokens without enforcing HTTPS endpoints. When discovered device authorization and token endpoints are non-loopback http URLs, on-path network attacker...