## Summary

The MCP OAuth implementation in `validate_trusted_redirect_uri` (`litellm/proxy/_experimental/mcp_server/oauth_utils.py`) allows administrators to configure trusted redirect origins via the `MCP_TRUSTED_REDIRECT_ORIGINS` environment variable. When configured with wildcard patterns (e.g., `*.example.com`), an attacker who controls a matching subdomain can intercept OAuth authorization codes and steal access tokens.

## Vulnerability Details

The `validate_trusted_redirect_uri` function validates OAuth redirect URIs through a chain of checks. The issue is in the trusted origin matching step: when `MCP_TRUSTED_REDIRECT_ORIGINS` contains wildcard entries, the validation performs suffix matching without verifying domain ownership.

### Affected Code

```python # oauth_utils.py - validate_trusted_redirect_uri (~line 486) def validate_trusted_redirect_uri(request: Request, redirect_uri: str) -> None: parsed = _parse_redirect_uri_for_validation(redirect_uri) if _validate_trusted_http_redirect_shape(parsed): return redirect_netloc = _strip_default_port(parsed.scheme, parsed.netloc) proxy_base = _resolve_proxy_base_for_redirect(request) if _trusted_red…