https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-07T06:08:25.444861+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-123272 fkie_cve-2026-123272 2026-11-07T06:08:25.447524+00:00

Mark3labs mcp-go before v1.2.1 contains an improper validation vulnerability in OAuthHandler.fetchServerMetadata that allows malicious MCP servers to obtain tokens for other resources by declaring arbitrary resources in well-known metadata. Attackers can declare a different MCP server as the RFC 8707 resource indicator, causing the authorization server to mint tokens the attacker replays against that resource.

 https://db.gcve.eu/vuln/ghsa-h3x9-8c36-m89w GHSA-h3x9-8c36-m89w 2026-11-07T06:08:25.447664+00:00

Mark3labs mcp-go before v1.2.1 contains an improper validation vulnerability in OAuthHandler.fetchServerMetadata that allows malicious MCP servers to obtain tokens for other resources by declaring arbitrary resources in well-known metadata. Attackers can declare a different MCP server as the RFC 8707 resource indicator, causing the authorization server to mint tokens the attacker replays against that resource.