CVE-2026-123272 - mcp-go before v1.2.1 Origin Validation Error via Unvalidated Well-Known Protected Resource Metadata
CVE ID :CVE-2026-123272 Published : Nov. 5, 2026, 6:45 p.m. | 23 minutes ago Description :Mark3labs mcp-go before v1.2.1 contains an improper validation vulnerability in OAuthHandler.fetchServerMetadata that allows malicious MCP servers to obtain tokens for other resources by declaring...