Oauth

MCP SSRF via OAuth PRM Discovery: How a 401 Turns Your Client Into a Proxy

27 February 2026·10 mins

Vulnerability Research Bug Bounty Mcp Ssrf Oauth Vulnerability-Research Responsible-Disclosure Bug-Bounty Python Typescript

Second article in my MCP security series. A malicious MCP server returns a 401 with a crafted WWW-Authenticate header pointing resource_metadata at any URL it wants. The MCP SDK fetches that URL without origin validation — blind SSRF, affects both Python and TypeScript SDKs, Claude Desktop, and Claude Code. Reported to Anthropic VDP, closed as duplicate. Full technical details disclosed here.

↑