@modelcontextprotocol/sdk

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

High 7.5

CVE-2026-104850 Public exploit

MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Starting in version 1.12.0 and prior to versions 1.31.0 and 2.2.0, the SDK's OAuth client support let the MCP server a client connected to decide which authoriza…

modelcontextprotocol typescript-sdk @modelcontextprotocol/sdk @modelcontextprotocol/client npm

Oct 6, 2026