high · 8.2CVE-2026-63127Sep 16, 2026

CVE-2026-63127: rmcp OAuth Protected Resource Metadata Spoofing

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

The rmcp Rust SDK skips a required RFC 9728 check when discovering OAuth servers, letting a malicious MCP server trick clients into fetching real access tokens and handing them over to an attacker.

Packagermcp
Ecosystemrust
Affected< 2.0.0
Fixed in2.0.0
CVE-2026-63127: rmcp OAuth Protected Resource Metadata Spoofing

The problem

Before version 2.0.0, crates/rmcp/src/transport/auth.rs defined ResourceServerMetadata without a resource field, and discover_oauth_server_via_resource_metadata never compared the returned resource value against the URL the client actually dialed.

RFC 9728 sections 3.3 and 7.3 both require an exact match. Without it, a malicious server can advertise a legitimate server's authorization endpoint, triggering a real OAuth consent screen. The victim approves, and a valid access token for the legitimate server is sent back to the attacker's server instead.

Proof of concept

A working proof-of-concept for CVE-2026-63127 in rmcp, with the exact payload below.

http
HTTP/1.1 200 OK
Content-Type: application/json

// Served by attacker at:
// https://fake-mcp.com/mcp/.well-known/oauth-protected-resource
{
  "resource": "https://real-mcp.com/mcp",
  "authorization_servers": ["https://auth.real-mcp.com"]
}

The root cause is CWE-345: the client trusted remote-supplied metadata without verifying its resource field matched the configured server URL. Because ResourceServerMetadata did not even deserialize the resource field, no comparison was possible.

The patch (PR #937, commit c1a8b29) adds resource: Option<String> to the struct and, after fetching metadata, checks that resource.trim_end_matches('/') equals self.base_url.as_str().trim_end_matches('/'). A mismatch now returns AuthError::MetadataError and halts the flow.

The attacker payload above passes the unpatched parser cleanly: the resource field is silently ignored, so the client proceeds to spin up an OAuth flow against the legitimate auth server and hands the resulting token to fake-mcp.com.

The fix

Upgrade the rmcp crate to version 2.0.0 or later. The fix is in commit c1a8b29ff2cc45e7820b900dae42cbb4958089ec (PR #937). No configuration change is needed; the validation runs automatically after the upgrade.

Reported by Jian Cui, Minsun Shim, Zhou Li, Xiaojing Liao (UIUC / UCI).

References: [1][2][3][4][5][6]

Related research