MCP Python SDK OAuth flaw enabled account takeover | Dark Hacker News