# CVE-2026-104850: MCP TypeScript SDK OAuth client credential injection via untrusted server

Source: https://junglewise.ai/threats/cve-2026-104850-mcp-typescript-sdk-oauth-client-could-send-credentials-to-an  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-06. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

CVE-2026-104850 · Severity: high · CVSS 7.5 · Published 2026-10-06

The MCP TypeScript SDK's OAuth client could be tricked by a malicious Model Context Protocol server into sending authentication credentials (refresh tokens, client secrets) to the wrong authorization server. An attacker controlling an untrusted MCP server could steal stored credentials or sign-in secrets without any user interaction, leading to account takeover and unauthorized access to protected services.

Technologies: [Anthropic @Modelcontextprotocol/Sdk](https://junglewise.ai/threats/technologies/anthropic-modelcontextprotocol-sdk), [@modelcontextprotocol/sdk (npm)](https://junglewise.ai/threats/technologies/modelcontextprotocol-sdk). Vendors: [Anthropic](https://junglewise.ai/threats/vendors/anthropic), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-104850 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-104850 being exploited in the wild.

**How severe is CVE-2026-104850?** High severity, with a CVSS score of 7.5, published 6 October 2026.

**Which products and versions are affected?** Anthropic @Modelcontextprotocol/Client 2.0.0 through 2.1.0; Anthropic @Modelcontextprotocol/Sdk 1.12.0 through 1.30.1; @modelcontextprotocol/client (npm) >= 2.0.0, < 2.2.0, SEMVER:introduced=2.0.0,fixed=2.2.0; @modelcontextprotocol/sdk (npm) >= 1.12.0, < 1.31.0, SEMVER:introduced=1.12.0,fixed=1.31.0.

**Is there a fix for CVE-2026-104850?** Yes. @modelcontextprotocol/client (npm): upgrade to 2.2.0 or later; @modelcontextprotocol/sdk (npm): upgrade to 1.31.0 or later. Until then: For bundled providers, add the `expectedIssuer` parameter to specify the correct authorization server. For credentials saved before the patch, add the `issuer` field or clear them so users sign in again. If an affected client may have connected to an untrusted MCP server, rotate client secrets and revoke tokens immediately. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-104850 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-104850?** Check whether you run Anthropic @Modelcontextprotocol/Client, Anthropic @Modelcontextprotocol/Sdk, @modelcontextprotocol/client (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @modelcontextprotocol/client (npm): upgrade to 2.2.0 or later

  ```sh
  npm install @modelcontextprotocol/client@2.2.0
  ```

- @modelcontextprotocol/sdk (npm): upgrade to 1.31.0 or later

  ```sh
  npm install @modelcontextprotocol/sdk@1.31.0
  ```


For bundled providers, add the `expectedIssuer` parameter to specify the correct authorization server. For credentials saved before the patch, add the `issuer` field or clear them so users sign in again. If an affected client may have connected to an untrusted MCP server, rotate client secrets and revoke tokens immediately.

## Technical details

The OAuth client fails to validate that credentials are sent only to their intended authorization server; instead it trusts the authorization server URL provided by the MCP server itself. An attacker running a malicious MCP server can specify an arbitrary authorization server endpoint, causing the client to send stored refresh tokens, client secrets, or bundled provider credentials to that attacker-controlled endpoint. The vulnerability requires the client to use OAuth over HTTP and connect to an untrusted MCP server, but exploitation requires no user interaction once credentials are stored.

## Affected products

- Anthropic @modelcontextprotocol/sdk 1.12.0 through 1.30.1
- Anthropic @modelcontextprotocol/client 2.0.0 through 2.1.0

## Identifiers

- CVE-2026-104850
- GHSA-6qxp-vccf-f47h

## Timeline

- 2026-10-06: disclosed: Advisory published

## Related threats

- [MCP TypeScript client SDK credential leak via cross-origin redirects](https://junglewise.ai/threats/cve-2026-111769-mcp-typescript-client-sdk-http-client-transports-and-oauth)
- [MCP TypeScript SDK memory exhaustion via unbounded validation](https://junglewise.ai/threats/cve-2026-111768-mcp-typescript-sdk-one-http-request-within-the-default-size)
- [MCP TypeScript SDK bearer authentication token validation bypass](https://junglewise.ai/threats/cve-2026-111771-mcp-typescript-sdk-server-bearer-authentication-accepted-tokens)
- [MCP TypeScript SDK denial of service via unbounded request body and JSON-RPC batch](https://junglewise.ai/threats/mcp-typescript-sdk-http-server-transports-and-handlers-did-not-limit-c51dda65)
- [MCP TypeScript SDK missing authorization in experimental tasks](https://junglewise.ai/threats/cve-2026-111767-mcp-typescript-sdk-experimental-tasks-were-not-tied-to-the)