Your MCP Server Just Decided Where You Log In: The OAuth Flaw to Fix This Week
The official MCP Python SDK sent client secrets and PKCE keys to whatever login server a remote MCP server pointed at. Fixes shipped in 1.30.0 and 2.2.0, and upgrading alone is not enough.
Read post →