PT-2026-137683
CVE-2026-123272
·
تاريخ النشر
2026-11-05
·
تاريخ التحديث
2026-11-05
الوصف من
CVSS 3.1
8.0
عاليةالمقاييسAV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
Mark3labs mcp-go before v1.2.1 contains an improper validation vulnerability in OAuthHandler.fetchServerMetadata that allows malicious MCP servers to obtain tokens for other resources by declaring arbitrary resources in well-known metadata. Attackers can declare a different MCP server as the RFC 8707 resource indicator, causing the authorization server to mint tokens the attacker replays against that resource.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾