Three MCP auth bugs in 30 days, one root cause: Trusting what the other side said

Three MCP ecosystem authentication vulnerabilities publicized during September 2026 stemmed from unverified input supplied by the opposite side of a connection. Affected MCP Python SDK versions could be manipulated by malicious servers into sending OAuth credentials, authorization codes, and PKCE verifiers to attacker-controlled token endpoints; fixes are available in versions 1.30.0 and 2.2.0, though machine-to-machine providers also require an explicit issuer setting and old registrations should be cleared. The Rust rmcp SDK before 2.0.0 failed to verify that protected-resource metadata described the connected server, allowing malicious servers to obtain tokens intended for legitimate resources, while LiteLLM before 1.84.0 accepted fabricated Authorization headers through an OAuth passthrough fallback, enabling unauthenticated access to MCP tools and services. LiteLLM’s flaw, rated CVSS 8.8, was added to CISA’s Known Exploited Vulnerabilities catalog after reported exploitation. Recommended mitigations include upgrading affected software, rotating potentially exposed credentials, restricting LiteLLM MCP routes until patched, validating OAuth issuers and resource identifiers on every discovery and fallback path, binding credentials to their proper issuer, and rejecting missing or invalid authentication data by default.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.