Authorization server accepts plain PKCE
The /authorize endpoint accepted code_challenge_method=plain.
What it means
OAuth 2.1 Section 7.5.2 removes the plain code_challenge_method. With plain the verifier and the challenge are the same string, so anyone who intercepts the authorization request also has the verifier and PKCE adds no protection. Only S256 is allowed. The check sends one /authorize request with a valid code_challenge value but code_challenge_method=plain. If the server responds with a redirect that carries an authorization code, PKCE-002 fires high. The server may still enforce S256 for other code paths; the check reports what the endpoint actually accepted.
How to fix
Reject any /authorize request whose code_challenge_method is not S256. Return a 302 redirect with error=invalid_request. Removal of plain is explicit in OAuth 2.1 and has been RECOMMENDED since RFC 7636.
Spec
OAuth 2.1 Section 7.5.2See it live
Our demo MCP server trips PKCE-002 on purpose. Scan it and you'll see this exact finding with evidence and fix text.
npx -y @patchbay-nebius/agent audit https://demo.patchbay-mcp.dev/mcp --probe-headless-oauthThe --probe-headless-oauth flag is opt-in because it sends crafted authorize requests; safe against our demo, do not point it at production servers you don't own.
Run the check against your own server:
npx -y @patchbay-nebius/agent audit <url-or-directory>No install: scan an MCP server in the browser and get a shareable report.
Disagree with this finding on your server? Open an issue with the --json output. False-positive reports are the most useful feedback.