Security firm Cycode disclosed a flaw in the official Model Context Protocol Python SDK, maintained by Anthropic, in which affected versions did not always verify where a connecting client’s OAuth discovery request pointed. A malicious MCP server could exploit a legacy fallback path to make the client send its client secret, authorization code, and PKCE proof key to an attacker-controlled endpoint, letting the attacker request a valid access token carrying the victim application’s permissions. The maintainers patched the flaw in SDK versions 1.30.0 and 2.2.0; no active exploitation had been reported as of disclosure.