Skip to content

Back to the catalog

A First Measurement Study on Authentication Security in Real-World Remote MCP Servers
arxiv.orgpaper

A First Measurement Study on Authentication Security in Real-World Remote MCP Servers

The first large-scale measurement study of authentication security across real-world remote MCP servers, scanning 7,973 live deployments and finding 40.55% expose tools with no authentication at all. For the 119 testable OAuth-enabled servers, the authors built a semi-automated (passive traffic inspection + active dynamic probing) detection framework and derived a taxonomy of nine flaw types across four categories — three MCP-specific (open client environments, dynamic client registration, delegated authorization) and conventional OAuth misconfigurations — finding every tested server had at least one flaw, with dynamic client registration flaws hitting 96.6% of servers and leading to information leakage or account takeover; the work resulted in 9 CVEs via responsible disclosure.

TL;DR First measurement study of MCP server auth finds 40.55% of 7,973 live servers unauthenticated and every tested OAuth-enabled server flawed, yielding 9 CVEs.
Open original ↗
Document

What it is

An arXiv paper (2605.22333) measuring authentication security across real-world remote MCP servers. Beyond the headline figures in the summary, the page names one concrete disclosed vulnerability and gives the deployment/flaw breakdowns and discovery method the reader needs to judge scope.

Named CVE

CVE-2025-61510 — an internet-exposed MCP server fronting a CRM system was intended to be internal but shipped with no authentication mechanism. Any client able to connect could invoke its tools and query over 5,000 internal enterprise records: customer names, email addresses, phone numbers, physical addresses. This is the concrete "sensitive data exposure" case behind the 40.55% unauthenticated figure — most unauthenticated servers the authors sampled were test/demo deployments, but this one leaked live PII. (The 9 CVEs cited in the summary are the OAuth-flaw disclosures; this CVE is separately the no-auth case.)

Breakdown the summary omits

Of 7,973 validated live servers:

  • No authentication: 3,233 (40.55%)
  • OAuth-based: 2,428 (30.45%)
  • Static token / API key: 2,312 (29.00%)

Across the 119 tested OAuth servers, 325 total flaws. The summary cites dynamic client registration flaws at 96.6%; the page adds a second dominant category — open client environment flaws affect 85.7% of servers.

Discovery method (reproducible)

Two-step pipeline: query FOFA and Shodan using MCP fingerprints — identifier signals (mcp-session-id, mcp-version), protocol strings (tools/call, tools/list, initialize payloads containing json-rpc), structure cues from endpoints like /info, while excluding text/html to drop ordinary sites. Then actively probe each candidate with an MCP initialize handshake, keeping only nodes returning a structurally valid JSON-RPC response. 28,715 candidates → 7,973 validated; sampled false-positive rate 1/100.

Why the attack surface is MCP-specific

An MCP server often acts as an OAuth Resource Server toward the client while simultaneously acting as an OAuth Client to upstream services (GitHub, Slack, databases). This dual role creates a multi-hop authorization chain enabling confused-deputy attacks against upstream resources — a structure absent from two-party OAuth. The attacker model assumes no malicious client is needed: sending arbitrary HTTP requests to public endpoints (e.g., abusing Dynamic Client Registration), hosting pages, and luring victims to crafted authorization URIs suffices.

What to do

If you run remote MCP servers: confirm HTTP/SSE endpoints are not exposing tools without auth (the single largest failure class here), and follow the current stable spec (2025-11-25), which prioritizes Client ID Metadata Documents and demotes Dynamic Client Registration to a backward-compatibility fallback. The 2025-06-18 revision mandates audience validation (RFC 8707 resource indicators) and RFC 9728 discovery — deployments predating these are where the flaws concentrate.

Caveats

The 119 OAuth servers were manually tested and represent a "fully testable" subset, not all 2,428 OAuth deployments. Validation of the remaining unauthenticated servers is deferred to future work, so the no-auth PII exposure may be broader than the single CVE reported.

Technologies named here

Techniques named here

  • Unauthenticated tool exposure
  • Dynamic client registration flaws
  • Open client environment flaws
  • Delegated authorization flaws
  • Conventional OAuth misconfigurations

Related in Identity & Access