{"id":"ghsa-ghsa-6prh-2h8m-c8cw","seq":2405,"kind":"advisory","title":"MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies","url":"https://github.com/advisories/GHSA-6prh-2h8m-c8cw","permalink":"https://vulnpulse.app/items/ghsa-ghsa-6prh-2h8m-c8cw","summary":"影響: npm:@modelcontextprotocol/sdk < 1.32.0 → 1.32.0, npm:@modelcontextprotocol/client >= 2.0.0, < 2.3.0 → 2.3.0\nSummary In affected versions, the SDK's HTTP client transports and OAuth requests followed redirects to any origin. If an MCP server or authorization server redirected a request to another origin, that origin received custom request headers (such as an X-API-Key set in requestInit.headers) and the mcp-session-id header. On a 307 or 308 it also received the request body, including OAuth token requests with their refresh_token and client_secret. On current runtimes fetch already drops the Authori…","severity":"medium","techs":["nodejs"],"cves":["CVE-2026-111769"],"tags":["GHSA-6prh-2h8m-c8cw","@modelcontextprotocol/sdk","@modelcontextprotocol/client"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-20T18:26:30.000Z","fetched_at":"2026-10-21T16:17:46.637Z"}