Mcp Remote
Monthly
Cleartext transmission in mcp-remote 0.8.0 through 0.14.3 allows unauthenticated on-path attackers to capture OAuth client secrets and issued access/refresh tokens when the device-code authorization flow uses non-loopback HTTP endpoints. Exploitation requires a man-in-the-middle network position and a victim actively initiating the device-code grant; no public exploit code exists, and the issue is rated medium severity (CVSS 4.0 base 6.0).
Cleartext transmission in mcp-remote 0.8.0 through 0.14.3 allows unauthenticated on-path attackers to capture OAuth client secrets and issued access/refresh tokens when the device-code authorization flow uses non-loopback HTTP endpoints. Exploitation requires a man-in-the-middle network position and a victim actively initiating the device-code grant; no public exploit code exists, and the issue is rated medium severity (CVSS 4.0 base 6.0).