The authors scanned the web and found 7,973 live remote MCP servers, of which 40.55% expose their tools without any authentication. Among the authenticated servers, OAuth is the dominant mechanism, but the deployments deviate from standard OAuth in three ways: open client environments, dynamic client registration, and delegated authorization. These deviations create new attack surfaces, leading the authors to define a taxonomy of four categories and nine specific flaw types.
To test real‑world impact, they built a semi‑automated detector that combines passive traffic inspection with active probing. Applying it to 119 OAuth‑enabled MCP servers, they found that every single server had at least one flaw, with 325 flaws total and dynamic client registration flaws affecting 96.6% of tested servers. Many of these flaws can leak sensitive data or allow account takeover; the authors obtained 9 CVE IDs through responsible disclosure. Since MCP is becoming the standard interface for LLM agents to access user‑linked services, these pervasive authentication weaknesses represent a serious security risk.