Ssrf

MCP SSRF via OAuth PRM Discovery: How a 401 Turns Your Client Into a Proxy

27 February 2026·8 mins

Vulnerability Research Bug Bounty Mcp Ssrf Oauth Vulnerability-Research Responsible-Disclosure Bug-Bounty Python Typescript

Second article in my MCP security series. A malicious MCP server returns a 401 with a crafted WWW-Authenticate header pointing resource_metadata at any URL it wants. The MCP SDK fetches that URL without origin validation, resulting in blind SSRF that affects both Python and TypeScript SDKs, Claude Desktop, and Claude Code. Reported to Anthropic VDP, closed as duplicate. Full technical details disclosed here.

↑