Claude Code patches an MCP OAuth bug that leaked tokens to the wrong host
Version 2.1.321 fixes MCP OAuth requests sending secrets such as refresh tokens to another host when a server redirected them.
Claude Code 2.1.321, released on 9 November, fixes an MCP OAuth bug where secrets such as refresh tokens could be sent to another host if the MCP server redirected the request. Anthropic’s changelog gives it one line, with no CVE number or severity rating.
The same release changes how much Claude Code trusts its own generated “mods”: mods it writes now turn on without asking in auto and bypass modes, even when allowUnsandboxedCommands is set to false or allowManagedDomainsOnly is on, and a mod’s own tool calls no longer raise a permission prompt except where a deny rule or org policy applies.
Why it matters: if you connect Claude Code to MCP servers that support OAuth, update to 2.1.321 so a malicious or compromised server can’t redirect its way into your refresh token. The mod auto-approval change is worth a separate look if you run Claude Code in bypass or auto mode: a mod now gets more latitude by default, and deny rules or org policy are the only backstop left.
The caveat: Anthropic hasn’t published a writeup beyond the changelog entry, so there’s no detail on how the redirect was exploited in practice or how it was found.