Nickelsec

Certain client paths in the SDK follow HTTP redirects to different origins, which can lead to the exposure of sensitive information. Specifically, when using `streamable http client`, `streamablehttp client`, `sse client`, `ClientSessionGroup`, `OAuth`, or the `create mcp http client` helper, the SDK forwards caller-supplied custom credential headers to the redirect destination. Additionally, for HTTP 307 or 308 responses, the request body is also forwarded. An attacker capable of influencing a trusted endpoint's redirect destination can capture these credentials and request bodies.

HTTP client transports and OAuth client requests follow redirects to different origins while retaining custom request headers and the `mcp-session-id` header. For HTTP 307 or 308 responses, request bodies are also retained. This behavior affects `StreamableHTTPClientTransport`, `SSEClientTransport`, and OAuth client functions such as `auth()`. A malicious or compromised MCP or authorization server could exploit this to receive sensitive information, including API keys, session identifiers, OAuth refresh tokens, or OAuth client secrets. This occurs when a request is redirected to another origin.