Spot the OAuth misconfiguration in this MCP server implementation

Attempt it

Click any words you think contain an error. Click again to unmark.

Mark at least one word to submit.

Quick reference

TL;DR

The token exchange skips PKCE verification, so an attacker who steals the authorization code can redeem it as the server, a classic confused-deputy escalation.

Memory aid

Sign in for the mnemonic that makes this stick. See Pro pricing.

Easy to grasp

Imagine a coat-check desk that gives you a ticket when you drop off your coat. PKCE is like writing a secret word on your half of the ticket and keeping the matching half in your pocket. When you return, the attendant checks both halves agree before handing back the coat. This server skips that check. It gives the coat to whoever shows up with any ticket stub, even one snatched from the trash. Worse, the server fetches the coat using its own master key, which opens far more closets than yours ever should. So a thief with a stolen stub walks away wearing the server's privileges, not just your own.

Key concepts

Confused deputy attack PKCE OAuth 2.1 Token audience binding

Quick scan · 2–4 min

Everything important, quickly.

5 min: locate the missing PKCE check, explain verifier and challenge binding, trace code interception to the confused-deputy escalation, then give the four-part secure pattern.

Side-by-side

Aspect	Vulnerable code	Secure pattern
PKCE check	Verifier never validated	Verifier re-hashed and matched before token issue
Token model	One static token reused across users	Per-user token minted at consent
Audience binding	Token accepted by any backend	Token scoped to one intended audience
Blast radius	Server's full credential scope	Single consenting user's scope
Consent	Implicit and server-wide	Explicit, per scope per user

Real-world examples

Real products, models, and research that use this idea.

The MCP authorization spec adopted OAuth 2.1 with mandatory PKCE in 2025, and reference servers like the GitHub and Sentry remote MCP servers verify the code_verifier server-side.
The OWASP MCP Top 10 (2025) lists confused-deputy and token-passthrough abuse as distinct high-severity risks for remote MCP servers.
Cloudflare and Stytch MCP OAuth guides explicitly warn against token passthrough and require per-user tokens with audience-restricted scopes.

Interviewer follow-ups

What an interviewer would ask next. Try answering before peeking at the approach.

QBeyond PKCE, what makes token passthrough such a dangerous anti-pattern for remote MCP servers?

Sign in or go Pro to see the approach for this follow-up.

QHow does audience binding via the aud claim actually stop a confused-deputy replay?

Sign in or go Pro to see the approach for this follow-up.

QWhy does OAuth 2.1 mandate PKCE even for confidential clients that hold a secret?

Sign in or go Pro to see the approach for this follow-up.

60-second cheat sheet

The night-before-the-interview bullets. Scan these on the way to the call.

Sign in for 5 unlocks/day or go Pro for unlimited revision sheets. See Pro pricing.

References

Primary sources. Skim if you want the original framing.