Junglewise Threat Intelligence

CVE-2026-63127: RMCP missing resource field validation in OAuth metadata

CVE-2026-63127 · Severity: high · CVSS 8.2 · Published 2026-09-16

Executive brief

The RMCP Rust library fails to validate the resource identifier field when discovering OAuth authorization servers through protected resource metadata. An attacker can set up a malicious MCP server that claims to represent a legitimate server, tricking clients into obtaining valid access tokens for the legitimate server and then sending them to the attacker's server. This enables account takeover and full impersonation of affected users on the legitimate service.

Technical details

The vulnerability is an insufficient verification of data authenticity (CWE-345) in OAuth Protected Resource metadata discovery, violating RFC 9728 requirements. The ResourceServerMetadata struct in crates/rmcp/src/transport/auth.rs lacks a resource field and the discover_oauth_server_via_resource_metadata() function performs no validation that the resource URL claimed in fetched metadata matches the URL actually being accessed. An attacker hosting a malicious MCP server can serve OAuth metadata claiming to represent a legitimate MCP server, causing rmcp clients to complete OAuth authorization with the legitimate server's authorization endpoint and then forward the resulting valid access tokens to the attacker's server. This requires user interaction (completing an authorization flow) but no privileges. The attack is exploitable over the network. Patch version 2.0.0 adds the missing resource field validation as specified in RFC 9728 sections 3.3 and 7.3.

Affected products

  • Model Context Protocol RMCP < 2.0.0

Timeline

  • 2026-06-29: disclosed: Advisory published by GitHub
  • 2026-06-27: patched: Fix merged in PR #937 to rmcp v2.0.0
  • 2026-09-16: advisory: Published to NVD and GitHub Advisory Database

References

Related threats