CVE-2026-108716

Name of the Vulnerable Software and Affected Versions mcp-remote versions 0.8.0 through 0.14.3

Description The software contains a cleartext transmission issue within the authorizeWithDeviceCode() function. This occurs when client secrets are sent and tokens are received without the enforcement of HTTPS endpoints. If the device authorization and token endpoints are non-loopback HTTP URLs, an on-path network attacker can capture the client secret as well as the issued access and refresh tokens.

Recommendations Update mcp-remote to a version later than 0.14.3. As a temporary mitigation, ensure that all device authorization and token endpoints use HTTPS to prevent cleartext transmission.