Disclosed weakness · no CVE recorded

Claude Code could forward MCP authorization secrets to a different host

Anthropic · Claude Code

First documented disclosure · Review checkpoint

Summary

An authorization request redirected by an MCP server could disclose a refresh token or other secret to a different host.

Severity and exploitation evidence

No CVSS score recorded in this review.

Exploitation not established: The release documents the correction. It does not identify a victim or malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The MCP OAuth client could forward sensitive request data when following a redirect across hosts.

Conditions required

An affected Claude Code client makes an MCP authorization request containing a secret and receives a redirect to another host.

Potential impact

The recipient could obtain the forwarded secret. The vendor did not report whether any recipient used a token or accessed an account.

Affected versions and configurations

Anthropic did not identify the full affected version range.

Fix and mitigation status

Anthropic lists the fix in Claude Code 2.1.321.

Practical next steps

Update Claude Code. If an unexpected redirect was observed, revoke the affected grant and review token activity with the authorization provider.

Operating lesson

Bind authorization secrets to the intended host whenever a client follows redirects.

Evidence and limits

Anthropic names refresh tokens as an example. The release does not identify an affected MCP server, a CVE or a specific exposure in a customer environment.

Sources