The MCP Python SDK, the Rust SDK (rmcp), and LiteLLM each accepted authentication input that nobody verified. Here is what broke, who is affected, and the checklist that closes the gap.
Three MCP auth bugs in 30 days, one root cause: Trusting what the other side said
calendar_today
October 2, 2026
domain
workos