OA1. Callback accepts the first request, whatever its state #2847

Which version line?

v2 — current (@modelcontextprotocol/inspector@latest)

Which client?

All / shared core

Inspector version

2.13.0 (v2/main @ d7f6cee, built from source)

Node version

v22.23.4

Operating system (and browser, for the web client)

Linux (Debian)

Transport

Streamable HTTP

MCP server under inspection

The repo's own OAuth test server: node test-servers/build/server-composable.js --config test-servers/configs/oauth-revocation-http.json (Streamable HTTP on :8083).

Steps to reproduce

OAuthCallbackServer sets handled = true on the first request to the callback path. An error response is not checked against state at all, and a success response is checked only later, inside the token exchange. Reproduced against the repo's OAuth test server: while the CLI waited on 127.0.0.1:6276, one request with ?error=access_denied&error_description=injected+by+another+process and no state ended the run with exit 1 and the message injected by another process. A genuine callback after that would get 409.

Expected behavior

Fix: ignore (with a short 400) any callback whose state does not match the flow in progress, error responses included, and keep listening until a matching one arrives or the timeout fires. Label server-supplied text in the error ("the authorization server said: …").

Actual behavior

The default port is fixed (6276), so any local process, or a web page that can make the browser request that URL, can cancel a sign-in and choose the text the CLI reports. PKCE still stops a forged code from being redeemed, so this is denial and message spoofing, not account takeover.

Logs, errors, or screenshots

No response

Already prototyped a fix?

No response

Before you submit

• I searched existing issues and this is not a duplicate.
• This is not a security vulnerability report (those go through the private advisory process).