Cycode reported an OAuth account-takeover flaw in the official MCP Python SDK, fixed in versions 1.30.0 and 2.2.0. No CVE had been assigned as of 29 September, so don’t wait for a scanner to tell you.
Tip: look at the version you’re running, today.
Sources: The Hacker News
