Auditing the MCP Python SDK and Authlib for OAuth Credential Leaks and Missing Signature Checks

Two September 2026 disclosures show Anthropic's MCP Python SDK can leak OAuth credentials to malicious MCP servers while Authlib can be tricked into trusting unsigned data, making signature validation, OAuth callback hardening, and dependency upgrades urgent for Python teams.