Anthropic MCP SDK flaw lets attackers hijack logins

Cycode has disclosed a high-severity account takeover vulnerability in Anthropic's MCP Python SDK. The issue affects versions 1.9.1 through 2.1.1 and involves the software's OAuth authentication flow.

A malicious MCP server could manipulate the login process and redirect credentials to an attacker while showing the user a genuine identity provider login page.

The finding centres on Anthropic's Model Context Protocol, an open protocol used to connect AI assistants to external tools and data sources. According to Cycode, the flaw allowed an attacker to intercept a client secret, an authorisation code and the PKCE proof key, then use them to obtain a valid access token and log in as the victim.

The attack relied on a fallback discovery path in the SDK's authentication process. When a server returned a 404 response to a discovery request, the SDK switched to an older method and accepted login configuration from the server without checking whether it matched the expected identity provider.

That omission bypassed a central security check meant to confirm that the named provider was genuine. An attacker could then control the token endpoint used by the client while still directing the user to a legitimate Google, Okta or Azure AD login page.

In that scenario, the victim would see what appeared to be a normal sign-in process. After the user authenticated, the SDK would send the resulting credentials package to the attacker-controlled endpoint instead of the real login provider.

How it works

The problem affected three authentication providers in the SDK: OAuthClientProvider, ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider. Cycode rated the issue High, with a severity score of 7.5.

The flaw was not limited to interactive logins. Machine-to-machine configurations using client credentials or private key JWT authentication could also be exposed, and those scenarios required no user interaction.

The impact could extend beyond a single compromised account. If the affected client had broad permissions across internal APIs, data stores, cloud services or deployment pipelines, an attacker could inherit those permissions as well.

Standard monitoring might also fail to detect the intrusion because the attacker would be using valid credentials through a legitimate authentication path. From the identity provider's perspective, the login could appear genuine.

Affected users

Users were exposed if their applications used Anthropic's MCP Python SDK as an HTTP client with one of the affected providers, connected to MCP servers they did not fully control and held credentials for a legitimate login provider.

Versions 1.9.1 through 1.29.1 lacked issuer checks and credential binding across any discovery path. Versions 2.0.0 through 2.1.1 included those checks on the modern discovery path, but not on the fallback path or a separate 403 redirection path.

Not all deployments were affected. MCP servers built with the SDK, local stdio clients and clients that attached their own tokens or headers were outside the scope of the issue.

Patch released

A fix is available in mcp 2.2.0 for the 2.x line and 1.30.0 for the 1.x line. The corrected versions determine the expected login provider before fetching configuration, reject configuration from a different provider and bind stored credentials to the provider they belong to.

Cycode also recommended additional steps after upgrading. These include specifying an issuer for pre-provisioned credentials in the machine-to-machine providers, clearing stored registrations created by older versions and rotating client secrets and revoking tokens if exposure to untrusted MCP servers was possible before the fix.

Seth Robbins, President & Chief Revenue Officer at Cycode, said the finding highlighted a wider risk as companies give AI agents and assistants broader access to enterprise systems and data.

Cycode reported the issue through Anthropic's security process, and the patch had already been released through coordinated disclosure.

"The practical effect: this isn't just 'someone can read my profile.' Depending on what the compromised client has access to, it's a foothold into whatever that client can reach - and the attacker keeps that foothold as long as the client secret isn't rotated," Robbins said.