Claude Code OAuth Tokens Can Be Stolen Through Stealthy MCP Hijacking

## Introduction Recently, security researchers from Mitiga discovered a critical vulnerability in the Claude Code system that allows attackers to hijack OAuth tokens through a technique known as Managed Control Plane (MCP) hijacking. This technique enables cybercriminals to stealthily redirect MCP traffic, compromising user credential security and allowing unauthorized access to Software as a Service (SaaS) platforms. ## What Happened Researchers found that by manipulating MCP traffic, attackers can intercept OAuth tokens used for authenticating and authorizing access to SaaS platforms. This technique not only allows for credential theft but also gives attackers the ability to maintain persistent access to these platforms, even after users change passwords or tokens. ### Timeline - **Vulnerability Discovery**: Mitiga researchers published their findings in May 2026. - **Public Disclosure**: The vulnerability was made public after confirmation from Mitiga, and a warning was issued to Claude Code users. ## Impact The impact of this vulnerability is significant, as many businesses rely on SaaS platforms for their daily operations. The ability for an attacker to maintain persistent access to these systems could lead to data breaches, theft of sensitive information, and large-scale security compromises. Organizations must act quickly to mitigate this threat. ## What Companies Should Do Companies using Claude Code and other SaaS platforms should implement additional security measures, such as multi-factor authentication (MFA) and continuous monitoring of network traffic. Additionally, it is crucial for users to be aware of the risks associated with using OAuth tokens and to adopt secure credential management practices. ## Key Points - The vulnerability allows for the theft of OAuth tokens through MCP hijacking. - Attackers can maintain persistent access to SaaS platforms. - User credential security is at risk. ## What This Case Teaches 1. Credential protection should be a priority for all companies. 2. Implementing multi-factor authentication is essential for enhancing security. 3. Continuous monitoring of network traffic can help identify suspicious activities.