Official MCP Python SDK OAuth Flaw Lets Malicious Servers Steal Client Secrets, Fixed in 1.30.0 and 2.2.0
A high-severity flaw in the official MCP Python SDK let a malicious server redirect OAuth credentials to an attacker's endpoint; fixes ship in 1.30.0 and 2.2.0, with extra steps needed.