Insufficient verification of data authenticity in MCP Python SDK - CVE-2026-115563
Published: November 9, 2026
Vulnerability identifier: #VU163092
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-115563
CWE-ID: CWE-345
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to steal OAuth credentials from MCP Python SDK clients.
The vulnerability exists due to missing authorization server issuer validation and credential binding in the SDK's OAuth client support when clients holding legitimate authorization server credentials connect to untrusted MCP servers over HTTP. An unauthenticated remote attacker can control an MCP server's discovery metadata to direct the client's credentials to an attacker-controlled token endpoint instead of the legitimate authorization server.
Affected software
MCP Python SDK
How to mitigate CVE-2026-115563
Install security update from vendor's website.
MCP Python SDK - addressed in versions 1.30.0, 2.2.0