Vulnerability Overview
A high-severity security vulnerability tracked as **CVE-2026-123272** has been disclosed in the Mark3labs mcp-go OAuth client library. The flaw, which affects versions v0.48.0 through v1.2.0, allows malicious Model Context Protocol (MCP) servers to obtain OAuth access tokens intended for other resources by exploiting improper validation in the `OAuthHandler.fetchServerMetadata` function.
The vulnerability carries a CVSS score of 8.0 and was reported privately by security researcher Theodoros Lampropoulos (@GimmyDatBeeR).
Technical Details
The vulnerability stems from insufficient validation when the OAuth client fetches Protected Resource Metadata (RFC 9728) from the well-known path of an MCP server. According to the GitHub security advisory, the client failed to apply RFC 9728 section 3.3 validation checks to metadata retrieved from the well-known path, though these checks were correctly applied to metadata advertised through WWW-Authenticate headers.
When connecting to an MCP server, the OAuth client would:
- Fetch Protected Resource Metadata from the server’s well-known path
- Accept the declared resource identifier without validation
- Use this unvalidated resource as the RFC 8707 resource parameter in:
– Dynamic client registration
– Authorization requests
– Token exchange operations
– Token refresh operations
Attack Scenario
A malicious or compromised MCP server could exploit this flaw by declaring a different MCP server as its resource identifier in the metadata. The OAuth client would then request an access token for that victim server from the authorization server. The attacker’s server would receive this token and could replay it against the victim resource, effectively stealing credentials intended for another service.
As stated in the commit message: “A resource that does not bind to the addressed MCP server is rejected instead of being used as the RFC 8707 resource indicator.”
Affected Versions
- **Vulnerable**: mcp-go versions v0.48.0 through v1.2.0
- **Patched**: mcp-go version v1.2.1 and later
Patch Details
The fix was implemented in commit 90d247e and released in version v1.2.1 on October 9, 2026. The patch introduces validation of the declared resource against the addressed resource when fetching metadata from the well-known path.
According to the pull request #1053, the fix implements a binding check that requires:
- Same scheme and host (case-insensitive comparison)
- Matching query, fragment, and userinfo components
- Path equal to or a segment-aware prefix of the addressed path
- Trailing slashes are ignored
The validation is intentionally designed to be slightly looser for well-known paths than for advertised paths, allowing servers mounted at paths like `/mcp` that declare their origin as the resource to continue functioning. However, any resource naming a different server is now rejected with the error message: “protected resource metadata from %q declares resource %q which does not match base URL %q”.
When a mismatch is detected, the metadata is not used, preventing the OAuth client from making registration or token requests with the malicious resource identifier.
Mitigation Recommendations
Organizations using mcp-go should take the following actions:
1. **Upgrade immediately** to mcp-go version v1.2.1 or later
2. Review logs for any suspicious OAuth token requests that may indicate exploitation attempts
3. Audit MCP server connections to ensure only trusted servers are configured
4. Consider rotating OAuth credentials if exploitation is suspected
Additional Context
The vulnerability affects the OAuth client transport component of mcp-go, specifically the code in `client/transport/oauth.go`. The fix includes comprehensive test coverage in `oauth_prm_resource_binding_test.go` to verify that mismatched resources are properly rejected and that legitimate OAuth flows continue to function correctly.
No evidence of active exploitation has been reported in the public sources at the time of disclosure.
