Threats affecting pkg:brew/mcp-proxy

PyJWT versions up to 2.13.0 and the current master branch contain a vulnerability where the HMAC verification accepts an empty key when using JWKs with an oct key type and an empty 'k' value. This allows an attacker to forge tokens without knowledge of a secret if the application verifies tokens using such a JWK. The issue arises because the empty key rejection implemented for string/bytes secrets was not applied to the JWK verification path. This flaw is fixed in PyJWT version 0.12.0_5.

The Model Context Protocol (MCP) Python SDK client versions 1.10.0 through 1.29.1 and 2.0.0 through 2.1.1 have a vulnerability where the client fetches server-declared external $ref URLs during tool output schema validation. This can cause the client to synchronously fetch arbitrary HTTP, HTTPS, or file URLs from the client's network position, potentially stalling the client if the target is unresponsive. The issue affects applications using the SDK as a client calling tools on untrusted servers. Fixed in versions 1.30.0 and 2.2.0.

The Model Context Protocol (MCP) Python SDK versions 1.8.0 through 1.29.1 and 2.0.0 through 2.1.1 have a vulnerability where their HTTP client transports follow cross-origin HTTP redirects and send custom headers and, on certain redirects, the request body to the redirected host. This behavior can expose sensitive headers like API keys if an attacker can cause a trusted endpoint to redirect to a malicious or unintended host. The SDK's OAuth client providers are similarly affected. The lone Authorization bearer header is not exposed due to existing HTTP library protections. MCP servers and clients with redirect following disabled are not affected. Fixed in MCP versions 1.30.0 and 2.2.0.