A vulnerability disclosed in the Model Context Protocol’s official TypeScript SDK let a connected MCP server designate which authorization server received a client’s stored OAuth credentials, without those credentials being bound to the server that issued them. A malicious or compromised MCP server could exploit this to receive a client’s refresh tokens or client secrets without any user interaction. The flaw affects the npm packages used by applications connecting to MCP servers over OAuth, and was fixed in updated SDK releases. No real-world exploitation has been reported.