I found OAuth credential exposure flaws in the official MCP Python and TypeScript SDKs. Why patching CVE-2026-115563 and CVE-2026-104850 may not be enough.
Six SAP Cloud SDK for Python releases skip tenant checks in Destination calls, enabling OAuth2 client secret leaks if attackers control tenant names.
Client-server is a relationship in which one program, the client, requests a service or resource from another program, the server. The label client-server was previously used to distinguish ...
Some results have been hidden because they may be inaccessible to you
Show inaccessible results