Cybersecurity & Data Protection
0
UPVOTE
thehackernews.com

Official MCP Python SDK Flaw Can Let Malicious Servers Steal OAuth Credentials

A malicious MCP server could trick an application built on the official MCP Python SDK into handing over the OAuth credentials it uses to log in to a real service, the SDK's maintainers said in a security advisory. Affected versions sent the client secret, the authorization code, and the PKCE proof key to a token endpoint the attacker controlled. The fix is in versions 1.30.0 and
Official MCP Python SDK Flaw Can Let Malicious Servers Steal OAuth Credentials
JA

jordan af

4h ago
0 0

Discussion

Get the discussion rolling

A single comment can start something great.

No comments yet.

Be the first to share your take and keep the conversation moving.

Join the conversation

Log in or sign up to add your comment and participate in the discussion!

Log In Sign Up

UPVOTERS

Community appreciation

See who found this content valuable and showed their support.

No upvotes yet.

Be the first to show your appreciation for this content.

TOPICS

Explore the same topics

Discover more content from the topics this post is mapped to.

bleepingcomputer.com
Japan's Keio confirms ransomware attack disrupted business syst…

Keio Corporation (Keio), a major private railway operator in Japan, said its network was hit by a ransomware attack over the weekend, disrupting  some of its b…
Thanakorn Boon

Thanakorn Boon

11h ago
0
thehackernews.com
Apple Patches CoreGraphics Flaw Possibly Exploited in Targeted …

Apple has released security updates to address a vulnerability in older versions of iOS, iPadOS, and macOS that it said may have been exploited in targeted att…
TN

The Hacker News

14h ago
0
darkreading.com
Carbonato Botnet Puts an AI Agent on Hacked Docker Hosts

The botnet uses the open source Hermes Agent AI framework to execute commands via Telegram and steal AI API keys from exposed Docker hosts.
DR

Dark Reading

14h ago
0
darkreading.com
One Packet Can Crash OT Servers in Industrial Sectors

A high-severity zero-day vulnerability affects the TDengine time-series database used across industrial, IoT, energy, and automotive environments.
DR

Dark Reading

15h ago
0
bleepingcomputer.com
JadePuffer agentic AI attacks target Azure, destroy cloud resou…

The JadePuffer ransomware operator is targeting Azure tenants with agent-driven attacks that conduct reconnaissance, steal credentials, and destroy core compon…
Carlos the great

Carlos the great

18h ago
0
thehackernews.com
⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents G…

A domain used as harmless placeholder text showed up in roughly 1, 700 repositories. Then somebody registered it and started serving malicious lures. That is t…
Nirano

Nirano

19h ago
0

Keep browsing

Explore more from this topic

Dive into the full feed of curated posts covering Cybersecurity & Data Protection.

Browse Topics

RELATED CONTENT

Continue exploring

Discover more content that aligns with your interests and this post.

thehackernews.com
Apple Patches CoreGraphics Flaw Possibly Exploited in Targeted …

Apple has released security updates to address a vulnerability in older versions of iOS, iPadOS, and macOS that it said may have been exploited in targeted att…
TN

The Hacker News

14h ago
0
thehackernews.com
⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents G…

A domain used as harmless placeholder text showed up in roughly 1, 700 repositories. Then somebody registered it and started serving malicious lures. That is t…
Nirano

Nirano

19h ago
0
thehackernews.com
Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Act…

Two new unpatched zero-day vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway appliances that allow remote code execution are being actively exploit…
TN

The Hacker News

2d ago
0
thehackernews.com
Lunex Stealer Abuses AMD Driver to Disable Security Monitoring …

The Psychedelic Stealer malware distributed via compromised Ukrainian websites using ClickFix-style Cloudflare verification checks is part of a wider malware-a…
TN

The Hacker News

2d ago
0
thehackernews.com
Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin …

Details have emerged about a high-severity security flaw in the Elementor Website Builder WordPress plugin that could be exploited by an unauthenticated attack…
TN

The Hacker News

3d ago
0
thehackernews.com
Compromised GitHub Actions Came Back Online and Resumed Executi…

Two actions-cool GitHub Actions have been disabled for a second time after the repositories became accessible last week, months after they were compromised dur…
TN

The Hacker News

3d ago
0

Still curious?

See more related posts

Keep the inspiration flowing with fresh submissions and trending finds from the community.

View Latest