Description

The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. Prior to 1.32.0 in @modelcontextprotocol/sdk and from 2.0.0 until 2.3.0 in @modelcontextprotocol/client, the HTTP client transports and OAuth client requests followed redirects to a different origin while retaining custom request headers and, for HTTP 307 or 308 responses, request bodies. The affected surfaces are StreamableHTTPClientTransport, SSEClientTransport, and OAuth client functions such as auth(). The trigger is an HTTP redirect to another origin. Custom headers and mcp-session-id can be re-sent to the redirected origin. HTTP 307 and 308 redirects can also re-send the request body. OAuth request bodies can contain refresh_token and client_secret values. Current runtimes already strip the Authorization header across origins. stdio clients do not use the affected HTTP path. A malicious or compromised MCP or authorization server could therefore receive API keys, session identifiers, OAuth refresh tokens, or OAuth client secrets. Restoring unrestricted redirect following after upgrading restores the exposure. This issue is fixed in @modelcontextprotocol/sdk 1.32.0 and @modelcontextprotocol/client 2.3.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-11-05T22:17:45.637Z",
  "pubdate": "2026-11-05T22:17:45.637Z",
  "executiveSummary": "The Model Context Protocol (MCP) TypeScript SDK is vulnerable to a cross-origin credential and sensitive data leakage flaw caused by improper HTTP redirect handling.\nThe vulnerability allows an attacker-controlled or compromised server to receive sensitive request metadata—including custom headers, session identifiers, OAuth refresh tokens, and client secrets—by issuing malicious HTTP redirects.\nAffected components include StreamableHTTPClientTransport, SSEClientTransport, and OAuth client functions. Stdio transport implementations remain unaffected.\nThe impact is significant, as it facilitates the exfiltration of authentication materials, potentially leading to unauthorized access to downstream resources or session hijacking.\nExploitation requires the client to follow an HTTP redirect to an origin controlled by the attacker. While runtime environments mitigate the leakage of the standard Authorization header, other custom headers and request bodies containing sensitive OAuth parameters are exposed during 307 and 308 redirects.\nUsers must upgrade to @modelcontextprotocol/sdk version 1.32.0 or @modelcontextprotocol/client version 2.3.0 to resolve this issue and avoid manually enabling insecure redirect configurations.",
  "technicalDetails": "The vulnerability stems from the default behavior of the underlying HTTP client transport mechanism in the Model Context Protocol TypeScript SDK, which failed to sanitize request headers and bodies when following cross-origin redirects.\nSpecifically, when an HTTP request is redirected (via 3xx status codes), the SDK failed to strip sensitive metadata, including custom headers and the mcp-session-id, when the destination host differs from the original request target.\nIn scenarios involving HTTP 307 (Temporary Redirect) or 308 (Permanent Redirect), the SDK incorrectly preserved the original request body in the redirected request. Because OAuth client functions utilize these transport mechanisms, sensitive OAuth parameters—such as refresh_token and client_secret—are transmitted to the destination origin of the redirect.\nThe attack flow proceeds as follows: 1) A client initiates a request to an MCP server or an authorization endpoint. 2) The malicious or compromised server responds with a 3xx redirect status code, pointing to an attacker-controlled endpoint. 3) The SDK client automatically follows this redirect, forwarding the sensitive headers (e.g., mcp-session-id) and, if a 307/308 status is used, the POST/PUT request body containing sensitive credentials.\nThe vulnerability affects @modelcontextprotocol/sdk prior to version 1.32.0 and @modelcontextprotocol/client between versions 2.0.0 and 2.3.0. While standard Authorization headers are currently stripped by runtime environments when crossing origins, the persistence of custom application-layer headers and sensitive body data creates a high-impact exfiltration path.\nPost-exploitation, an attacker successfully captures the redirected credentials or session tokens. These captured values can be replayed to authenticate as the victim, impersonate the client within the MCP ecosystem, or compromise external services relying on the leaked OAuth tokens.\nThe fix involves explicitly restricting redirect following logic to ensure that sensitive data is only transmitted when the origin remains unchanged, effectively disabling the propagation of credentials across different domains during redirects."
}