# OpenCode Flaw Enables Code Execution via Malicious MCP Servers

> Source: <https://osintsights.com/opencode-flaw-enables-code-execution-via-malicious-mcp-servers>
> Published: 2026-10-22 11:21:47+00:00

A critical flaw in OpenCode's MCP sign-in flow, rated 9.8/10 in severity, allows malicious MCP servers to execute code, posing a significant threat to users. This vulnerability was privately reported on August 29 and publicly disclosed on October 19, with a fix released in version 1.18.33 on September 28.