Official MCP Python SDK flaw can let malicious servers steal OAuth credentials

Affected versions of the official MCP Python SDK could allow a malicious MCP server to redirect OAuth credentials to an endpoint controlled by the attacker. The source reports no attacks exploiting the flaw.