MCP Python SDK OAuth. The access path.
A 404 on server metadata sent the client secret to an attacker. The patch takes a minute. Working out which client secrets left your estate takes longer.
The record
Entry point. mcp-client, asks the server where to log in.
The identity in the middle. The MCP client client_secret, posted together with the code and the PKCE verifier.
What was reached. saas-data, attacker mints tokens at the real provider.
A 404 on server metadata sent the client secret to an attacker.
The path, step by step.
Taken from the published reporting. Nothing here is reconstructed.
| Step | Role in the path | What the reporting records |
|---|---|---|
| mcp-client | Entry | asks the server where to log in |
| server-metadata | Step | 404, client falls back to legacy discovery |
| attacker-issuer | Step | claims to be the real provider, unvalidated |
| client-secret | Step | secret, code and PKCE verifier posted to attacker |
| saas-data | Reached | attacker mints tokens at the real provider |
Where a breakpoint would have been
The fallback to legacy discovery. Treating a 404 as a reason to trust an unvalidated issuer is the one step that turns a missing file into a credential handover.
A breakpoint is the single change that closes a path with the least disruption. Read how that is chosen in the breakpoint page. The full narrative is in the teardown.
5 steps from entry to data.
Where this comes from.
Every field on this page is taken from the published reporting below. The breakpoint assessment is Elmoz reading that path, not a statement about what the affected organisation did.
GitHub Security Advisory GHSA-qx49-fqc8-xw99 · Cycode · The Hacker News
Questions, answered.
The two questions this record answers.
What was the entry point in the MCP Python SDK OAuth incident?
The published path starts at mcp-client, asks the server where to log in.
What did it reach?
The last step in the published path is saas-data, attacker mints tokens at the real provider.
Other incidents.
Same database, different path shape.
See what your agents can reach. Before someone else does.
Book a demo and we walk through the access paths in an environment like yours.