MEDIUM 6.5 GitHub
CVE-2026-111769
MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies
### Summary
In affected versions, the SDK's HTTP client transports and OAuth requests followed redirects to any origin.
If an MCP server or authorization server redirected a request to another origin, that origin received custom request headers (such as an `X-API-Key` set in `requestInit.headers`) and the `mcp-session-id` header. On a `307` or `308` it also received the request body, including OAuth token requests with their `refresh_token` and `client_secret`.
On current runtimes `fetch` alre
Affected Products
- npm/@modelcontextprotocol/sdk < 1.32.0
- npm/@modelcontextprotocol/client >= 2.0.0, < 2.3.0
References
- https://github.com/advisories/GHSA-6prh-2h8m-c8cw
- https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-6prh-2h8m-
- https://github.com/modelcontextprotocol/typescript-sdk/pull/2901
- https://github.com/modelcontextprotocol/typescript-sdk/pull/2902
This medium severity vulnerability with a CVSS score of 6.5 was published on 2026-10-20 via GitHub. Affected: npm/@modelcontextprotocol/sdk < 1.32.0, npm/@modelcontextprotocol/client >= 2.0.0, < 2.3.0.
vulnfeed aggregates 18176 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.