Evidence · DiggingBeagle record
mcp-go OAuth resource identity mix-up advisory
- Source role
- vendor statement
Evidence record
Claim-level citations (1)
- supportsmcp-go trusted the wrong resource identity on its well-known OAuth path: mcp-go 0.48.0 through 1.2.0 trusted an attacker-advertised protected-resource identity, potentially obtaining bearer credentials for a different target resource; fixed in 1.2.1.
GHSA-xf6j-693p-wqxx, Description, Affected versions and Patched versions