MCP: OAuth Server Redirect URI Mismatch Bug

[Shubham-DK]

Type: Bug

VSCode's OAuth implementation for MCP servers (and dynamic auth providers) has a redirect URI mismatch issue when the default loopback port (33418) is unavailable. This causes authentication to fail with "Invalid Redirect URI" errors from OAuth authorization servers.

The issue occurs due to a mismatch between:

• Redirect URIs registered during Dynamic Client Registration (DCR)
• Actual redirect URI used during the authorization flow

Steps to Reproduce:

1. Connect to a protected MCP Servers which uses an AS which supports DCR.
2. During DCR VSCode registers these redirect URIs:

redirect_uris: [
'https://insiders.vscode.dev/redirect',
'https://vscode.dev/redirect',
'http://127.0.0.1/',
http://127.0.0.1:${DEFAULT_AUTH_FLOW_PORT}/ // 33418
]

3. But during Authorization endpoint call lets say I have many instance of vscode running, or the port 334418 is not free than in that case it using random available port and sending that in authorize url
   ex:
   https://oauth.aidevhub-dev.com.sg/oauth/authorize?client_id=eee62b7e-aede-4bce-a67f-ff93b7c6fb93&response_type=code&code_challenge=WalsfQG3deeyGS1RbSNou6wPIhEJ6uhZF4vWRXmscSc&code_challenge_method=S256&scope=openid+profile+email&resource=https%3A%2F%2Fsiacontext.mcp-dev.sq.com.sg%2Fmcp&redirect_uri=http%3A%2F%2F127.0.0.1%3A59656%2F&state=ey%2FlnTwSm9FUcQN%2FQds%2BCg%3D%3D

4. When you open the url and go to browser you will see this error " "Invalid Redirect URI - The redirect URI is not registered for this client"

Expected Behaviour:
Authentication should succeed regardless of which port the loopback server binds to.

VS Code version: Code 1.106.2 (Universal) (1e3c50d, 2025-11-19T16:56:50.023Z)
OS version: Darwin arm64 24.6.0
Modes:

System Info

Item	Value
CPUs	Apple M3 Pro (12 x 2400)
GPU Status	2d_canvas: enabled direct_rendering_display_compositor: disabled_off_ok gpu_compositing: enabled multiple_raster_threads: enabled_on opengl: enabled_on rasterization: enabled raw_draw: disabled_off_ok skia_graphite: enabled_on trees_in_viz: disabled_off video_decode: enabled video_encode: enabled webgl: enabled webgl2: enabled webgpu: enabled webnn: disabled_off
Load (avg)	33, 15, 11
Memory (System)	36.00GB (0.15GB free)
Process Argv	--crash-reporter-id 449765cb-dc68-45f8-81ee-65ca2c30f04e
Screen Reader	no
VM	0%

Extensions (67)

Extension	Author (truncated)	Version
claude-code	Ant	2.0.47
color-info	bie	0.7.2
markdown-emoji	bie	0.3.1
vscode-tailwindcss	bra	0.14.29
npm-intellisense	chr	1.4.5
kubeseal	cod	0.0.8
postcss	css	1.0.9
vscode-markdownlint	Dav	0.60.0
vscode-eslint	dba	3.0.16
gitlens	eam	17.7.1
vscode-html-css	ecm	2.0.13
prettier-vscode	esb	11.0.0
figma-vscode-extension	fig	0.4.3
auto-rename-tag	for	0.1.10
copilot	Git	1.388.0
copilot-chat	Git	0.33.2
gc-excelviewer	Gra	4.2.64
plantuml	jeb	2.18.1
vscode-bicep	ms-	0.39.26
vscode-containers	ms-	2.3.0
vscode-dotnet-runtime	ms-	2.3.7
vscode-kubernetes-tools	ms-	1.3.26
debugpy	ms-	2025.16.0
python	ms-	2025.18.0
vscode-pylance	ms-	2025.9.1
vscode-python-envs	ms-	1.12.0
jupyter	ms-	2025.9.1
jupyter-keymap	ms-	1.1.2
jupyter-renderers	ms-	1.3.0
vscode-jupyter-cell-tags	ms-	0.1.9
vscode-jupyter-slideshow	ms-	0.1.6
copilot-mermaid-diagram	ms-	0.0.3
extension-test-runner	ms-	0.0.12
vscode-copilot-vision	ms-	0.1.1
vscode-speech	ms-	0.16.0
vscode-websearchforcopilot	ms-	0.1.4
color-highlight	nau	2.8.0
emoji	Per	1.0.1
vscode-versionlens	pfl	1.22.4
material-icon-theme	PKi	5.28.0
prisma	Pri	7.0.0
java	red	1.49.0
vscode-xml	red	0.29.0
vscode-yaml	red	1.19.1
format-code-action	roh	0.1.0
roo-cline	Roo	3.33.2
markdown-preview-enhanced	shd	0.8.20
svg-preview	Sim	2.8.3
sonarlint-vscode	Son	4.35.1
vscode-pets	ton	1.34.0
vscode-mdx	uni	1.8.17
intellicode-api-usage-examples	Vis	0.2.9
vscodeintellicode	Vis	1.3.2
explorer	vit	1.32.1
vscode-boot-dev-pack	vmw	0.2.2
vscode-spring-boot	vmw	1.64.1
migrate-java-to-azure	vsc	1.7.6
vscode-gradle	vsc	3.17.1
vscode-java-debug	vsc	0.58.3
vscode-java-dependency	vsc	0.26.5
vscode-java-pack	vsc	0.30.5
vscode-java-test	vsc	0.43.2
vscode-java-upgrade	vsc	1.8.0
vscode-maven	vsc	0.44.0
vscode-spring-boot-dashboard	vsc	0.14.0
vscode-spring-initializr	vsc	0.12.0
plantuml	wel	2.17.6

A/B Experiments

vsliv368:30146709
binariesv615:30325510
nativeloc1:31344060
dwcopilot:31170013
dwoutputs:31242946
copilot_t_ci:31333650
e5gg6876:31282496
pythonrdcb7:31342333
aj953862:31281341
nes-set-on:31351930
6abeh943:31336334
c12345:31413568
0574c672:31404437
f1c06875:31397863
cloudbuttont:31379625
todos-1:31405332
v66_all_req:31402695
control_gpt5applypatchexclusively:31412085
3efgi100_wstrepl:31403338
trigger-command-fix:31379601
auto_model_enabled:31385282
use-responses-api:31390855
9i271672:31419540
je187915:31401257
v2prompt_9f72f763:31415580
ec5jj548:31422691
copilot-nes-oct-t:31418199
ff8f5884:31411053
defaultvisibility:31420717
defaulttokens:31420721
c0683394:31419495

[TylerLeonhardt]

The authorization server MUST allow any port to be specified at the
time of the request for loopback IP redirect URIs, to accommodate
clients that obtain an available ephemeral port from the operating
system at the time of the request.

from https://datatracker.ietf.org/doc/html/rfc8252#section-7.3

This MCP Server is not doing the right thing that the OAuth spec says to do.