https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 17:15:42 +0000 https://db.gcve.eu/vuln/cve-2026-63127 <p><strong>Affected:</strong> modelcontextprotocol rust-sdk</p> <p>RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate&#39;s OAuth implementation in crates/rmcp/src/transport/auth.rs omits the RFC 9728 resource field from ResourceServerMetadata and allows discover_oauth_server_via_resource_metadata to use protected-resource metadata without confirming that the returned resource identifier exactly matches the configured MCP server. A malicious MCP server can publish metadata for a different legitimate MCP resource and its authorization server, causing a victim who connects and completes the authorization flow to obtain a legitimate access token that the client subsequently sends to the malicious server. The attacker can capture the token and impersonate the victim against the legitimate MCP resource within the token&#39;s granted scopes. This issue is fixed in version 2.0.0.</p> <p><strong>Affected:</strong> modelcontextprotocol rust-sdk</p> <p>RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate&#39;s OAuth implementation in crates/rmcp/src/transport/auth.rs omits the RFC 9728 resource field from ResourceServerMetadata and allows discover_oauth_server_via_resource_metadata to use protected-resource metadata without confirming that the returned resource identifier exactly matches the configured MCP server. A malicious MCP server can publish metadata for a different legitimate MCP resource and its authorization server, causing a victim who connects and completes the authorization flow to obtain a legitimate access token that the client subsequently sends to the malicious server. The attacker can capture the token and impersonate the victim against the legitimate MCP resource within the token&#39;s granted scopes. This issue is fixed in version 2.0.0.</p> https://db.gcve.eu/vuln/cve-2026-63127