A researcher reports that a malicious or compromised remote MCP server can steer OAuth discovery in the official Python and TypeScript SDKs, so a client sends credentials issued for one authorisation server to another. Exposed material can include client secrets and refresh tokens. Fixes are in Python 1.30.0 and 2.2.0, and TypeScript 1.31.0 and 2.2.0, but upgrading alone is not enough for some set-ups. Teams should set the issuer explicitly, clear stored registrations that lack issuer binding, and rotate secrets if clients have contacted untrusted servers.
