Improper validation in the `fetchServerMetadata()` function of the `OAuthHandler` allows malicious MCP servers to obtain tokens for unauthorized resources. By declaring arbitrary resources in well-known metadata, an attacker can specify a different MCP server as the RFC 8707 resource indicator, leading the authorization server to issue tokens that the attacker can then replay against that resource.