Repository navigation
v2 MCP OAuth follows cross-origin redirects with request bodies #55166
Description
What happened?
OpenCode v2.0.28 pins @modelcontextprotocol/client 2.0.0. The published GHSA-6prh-2h8m-c8cw advisory identifies client versions below 2.3.0 as affected by cross-origin redirects forwarding custom headers and request bodies. Current dev also pins 2.0.0.
I reproduced body forwarding with the official macOS arm64 v2.0.28 binary and two synthetic loopback origins: an OAuth registration endpoint returned HTTP 307, and the second origin received one POST with its body. The fixture stopped before consent or token issuance. No real credentials, account content or model calls were used.
Expected behavior
Cross-origin redirects must not forward OAuth bodies or custom MCP headers. Same-origin redirects should continue to work.
Proposed fix and verification
Upgrade the MCP client/core/server packages to 2.3.0, retaining OpenCode's existing client patch. The locally built patched binary sends zero requests/bodies to the second origin. Four regression cases cover cross-origin blocking and same-origin success for the HTTP transport and OAuth refresh. This does not change anonymous discovery, lazy sign-in, explicit OAuth initiation or replay behavior.
This is separate from the v1 explicit-login backport in #55139.
Activity
holny commentedon Oct 13, 2026
I'd like to take this. The local repro (loopback 307 + body forwarding) and the proposed upgrade to
@modelcontextprotocol/client2.3.0 with four regression cases (cross-origin blocked / same-origin allowed, for both HTTP transport and OAuth refresh) match what I want to land — will base onorigin/v2, runbun testagainstpackages/core/src/mcp/, and open a PR with a CVE reference in the body.111mihir commentedon Oct 13, 2026
Submitted as #55167 against
dev, per this repository's contribution instructions. The PR references GHSA-6prh-2h8m-c8cw; the published advisory has no CVE ID.holny commentedon Oct 14, 2026
Correction: I missed an earlier PR (#55167) that already ships the same 2.3.0 bump + patch rewrite + 4 regression tests. Closing my local head and stepping aside in favor of #55167. Apologies for the noise.
Skeptomenos commentedon Oct 22, 2026
Thank you for the report.
Requested: move
@modelcontextprotocol/clientfrom the exact pin2.0.0to2.3.0or later (2.3.1 is the current release). The pin is atpackages/core/package.json:107andbun.lock:1888in tagv2.1.2;devalso pins 2.0.0 (checked 2026-10-22).Affected range:
>= 2.0.0, < 2.3.0(GHSA-6prh-2h8m-c8cw). A redirect to another origin re-sends custom headers and themcp-session-idheader; on a 307 or 308 it also re-sends the request body, including OAuth token requests. 2.3.0 also includes the 2.2.0 fix for GHSA-6qxp-vccf-f47h.From 2.3.0, redirects are followed only within the same origin by default (
fetchWithinOrigin). Please:redirectPolicy: "follow";patches/@modelcontextprotocol%[email protected]onto the new package layout.PR #55167 already contains this move to 2.3.0; a review of it would close this issue.