This article was published on [9th Oct 2026]
Preface: Any frontier model can act as the “brain” driving an MCP TypeScript server through standard wrappers. The following models are natively supported out of the box through adapters like the Vercel AI SDK:
• Claude (Anthropic): Claude 3.5 Sonnet and other Anthropic models have native, first-class support for MCP servers.
• GPT (OpenAI): GPT-4o and other OpenAI models connect natively via standard JSON-RPC messaging.
• Gemini (Google): Fully compatible with the TypeScript SDK’s high-level server routing.
The Model Context Protocol (MCP) TypeScript SDK is affected by CVE-2026-104850. However, the vulnerability behaves in a specific way that impacts MCP clients, rather than the server codebase itself.
Background: To understand the specific details of CVE-2026-104850, the following explanation will be based on the accompanying infographic. TypeScript code block in the top-left corner on attached infographic.
“This snippet demonstrates how an attacker sets up a rogue MCP server as a Proof of Concept. By utilizing the official SDK’s server[.]registerResource API, they register a resource path called auth-config. When an unsuspecting client connects and requests this authentication configuration, the server returns custom JSON metadata.”
“The critical threat sits inside this return payload: the attacker explicitly hardcodes the token_endpoint parameter to point to an external domain under their control, rather than the legitimate authentication server.”
“In versions of the MCP TypeScript SDK prior to 1[.]31[.]0 and 2[.]2[.]0, the client-side OAuth component suffers from a significant validation gap. It does not verify whether the dynamic token endpoint supplied by the server actually belongs to a trusted, legitimate Identity Provider (IdP).”
“Because the client blindly trusts whatever URL the MCP server provides, it initiates the token exchange sequence with the wrong host. As a result, critical secrets—including the client_secret, the temporary auth_code, and the PKCE verifier—are transmitted directly to the attacker’s server, as highlighted by the impact indicator in the top right.”
Vulnerability details: This specific flaw (CVE-2026-104850) exists in the official MCP TypeScript SDK package. It allows a malicious or compromised MCP server to use dynamic metadata configurations to trick client applications—such as AI agents, UI clients, or IDE integrations—into handing over private cloud credentials or OAuth refresh tokens.
Remedy: To remediate this risk, organizations must immediately upgrade their @modelcontextprotocol/sdk dependencies to versions 1[.]31[.]0 or 2[.]2[.]0 and above.
Official announcement: For more details, please refer to link –