High · 7.5 CVE-2026-51995 EUVD-2026-86018GHSA-5wmf-76f4-cg47

An issue in geelen mcp-remote 0.1.32 through 0.1.38 allows a remote attacker to obtain sensitive information via the src/lib/authorization-…

Published Sep 24, 2026 · Updated Sep 24, 2026 · Assigned by mitre

Description

An issue in geelen mcp-remote 0.1.32 through 0.1.38 allows a remote attacker to obtain sensitive information via the src/lib/authorization-server-metadata.ts, src/lib/utils.ts components

References

https://github.com/geelen/mcp-remote
https://github.com/geelen/mcp-remote/security/advisories
https://github.com/playb0t/mcp-remote-oauth-security#readme
https://github.com/playb0t/mcp-remote-oauth-security/blob/v1.0.1/advisories/F-02-authorization-server-ssrf.md