TLDR Tech / InfoSec
The MCP AuthN/Z Nightmare
Doyensec maps the full OAuth 2.0/dynamic client registration attack surface in MCP deployments, covering tool poisoning, rug pulls, schema poisoning, prompt injection via tool responses, command injection (CVE-2025-53100, CVE-2025-53818), SSO metadata manipulation (CVE-2025-4144, CVE-2025-4143), DNS rebinding against unauthenticated localhost WebSocket servers, and OIDC discovery endpoint abuse. The proposed Identity Assertion JWT Authorization Grant (JAG) enterprise authorization model introduces four unresolved risks: no token revocation path for misbehaving agents, LLM-driven scope escalation without user consent, undefined client credential issuance enabling scope namespace collision and resource identifier injection, and ID-JAG replay amplifying blast radius across multiple MCP access tokens. Security teams auditing MCP deployments should treat every step of the authorization chain as an injection point and prioritize mTLS/certificate-based trust anchors, strict resource namespacing, centralized access invalidation, and explicit per-action consent gates for high-risk tool calls.
Read the full story