Tuesday 15 September 2026
Evening EditionRSS

ZOTPAPER

News without the noise

ZOTPAPER
Safety & Evals

First measurement study reveals widespread authentication flaws in remote MCP servers

Over 40% of 7,973 live servers expose tools without authentication, and all tested OAuth-enabled servers exhibit at least one security flaw.

PaperTop Universitycs.CRarXiv:2605.22333v1 ↗
Huijun Zhou · Xiaohan Zhang · Haozhe Zhang · Haoyang Zhang · Mi Zhang · Min Yang

Fudan University · Central South University

Research Digest··2 min read
Read the paper →
Thread:Agent Security & Attacks
Zhou et al. conducted the first systematic measurement of authentication security in real-world remote Model Context Protocol (MCP) servers, scanning over 7,900 live servers and performing in-depth analysis on 119 OAuth-enabled servers. They found that 40.55% of servers require no authentication, and among authenticated servers, every tested server had at least one authentication flaw, with 96.6% vulnerable to dynamic client registration attacks.

What they did

The authors built a custom scanner to identify MCP servers by probing common ports and endpoints, discovering 7,973 live remote MCP servers. They then analyzed authentication mechanisms, focusing on the 119 servers that used OAuth and were accessible for testing. They developed a semi-automated detection framework combining passive traffic inspection (analyzing OAuth handshakes) with active dynamic probing (testing for misconfigurations like overly permissive redirect URIs or insecure client secrets). Based on observed patterns, they derived a taxonomy of MCP-specific authentication flaws including open client environments, dynamic client registration, and delegated authorization issues, plus conventional OAuth misconfigurations.

Key findings

  • 40.55% of live remote MCP servers (3,233 out of 7,973) expose tools with no authentication whatsoever.
  • Among 119 testable OAuth-enabled servers, all had at least one flaw, with a total of 325 distinct flaws detected.
  • Dynamic client registration flaws affected 96.6% (115 out of 119) of tested servers, enabling attackers to register their own clients and intercept tokens.
  • Many flaws could lead to sensitive information leakage and account takeover; the authors obtained 9 CVE IDs through responsible disclosure.

Why it matters

This study highlights that the MCP ecosystem, which is increasingly used to connect LLMs to external services like social media and banking, has pervasive authentication weaknesses. The findings challenge the assumption that OAuth integrations are secure by default and underscore the need for hardened OAuth deployments, especially given the unique characteristics of MCP as an agent protocol.

Caveats

The study only examined remote MCP servers that were publicly discoverable, so the sample may not represent private or enterprise deployments. The dynamic testing framework may have missed flaws that require domain-specific context, and the authors note that some servers may have hardened after the study period. Additionally, the taxonomy is derived from observed patterns and may not cover all possible attack vectors.

§

Analysis

This work is significant as it provides the first empirical baseline for authentication security in the emerging MCP ecosystem, which is central to many agent architectures. The identified flaws echo known issues in OAuth deployments but are amplified by the unique properties of MCP, such as dynamic client registration and delegated authorization. The study opens questions about how to design secure authentication protocols for agent-to-service interactions.

newspaper

Research Digest

Articles published under the Zotpaper byline are synthesized from multiple source publications by our AI editor and reviewed by our editorial process. Each story combines reporting from credible outlets to give readers a balanced, comprehensive view.

Editorial ProcessSubscribe