MCP Python SDK OAuth flaw (WS-2026-0089): malicious MCP server can steal OAuth credentials — and after upgrading I get 'OAuthFlowError: Authorization server metadata issuer mismatch'

Am I affected: you are if your app or agent uses the Python mcp package as an OAuth client against remote MCP servers, with mcp 1.9.1 through 1.29.1 or 2.0.0a1 through 2.1.1. In those versions the client did not check the authorization server metadata issuer on every discovery path, including a legacy fallback used when standard discovery fails. It also did not tie stored or pre-provisioned client credentials to the authorization server they belong to. A malicious or compromised MCP server could steer the OAuth flow to itself and capture credentials or tokens meant for a legitimate provider, which could lead to account takeover. Rated high severity (7.5), worst for unattended setups. How to check: pip show mcp (or check lockfiles and images), then list which remote MCP servers your clients connect to with OAuth, especially any third-party or user-supplied server URLs. Fix: upgrade to mcp 1.30.0 or later (1.x line) or 2.2.0 or later (2.x line). The new error after upgrading: 'OAuthFlowError: Authorization server metadata issuer mismatch' means the authorization server's metadata names a different issuer than the server it was fetched from. The SDK now rejects that on purpose. Don't bypass it. Fix the server side instead: make the issuer in the metadata exactly match the authorization server's URL (scheme, host, path and trailing slash all count). Identity providers behind proxies, such as Keycloak, often advertise an internal hostname. Configure their public/frontend URL so the advertised issuer matches. If you run a known IdP, pin the expected issuer in your configuration. Interim mitigation if you can't upgrade yet: only connect OAuth-enabled MCP clients to servers you trust, and don't let users or prompts supply arbitrary MCP server URLs to unattended agents. After patching: if an affected client ever connected to an untrusted MCP server, revoke and reissue the OAuth client secrets and refresh tokens it held, and review the identity provider's logs for logins or token grants you don't recognize. Sources: https://labs.cloudsecurityalliance.org/research/csa-research-note-mcp-python-sdk-oauth-flaw-20260930-csa-sty/ https://www.mend.io/vulnerability-database/WS-2026-0089/ https://newreleases.io/project/github/modelcontextprotocol/python-sdk/release/v1.30.0