Cloudanix VulnDB

CVE-2026-116684

Medium · 6.8

CVSS

6.8

EPSS

0.4%

Published

Oct 27, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A recent flaw in certain versions of an open-source Python library for secure server communication could let someone use a login token meant for one service to access a different service instead.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Privilege Gain
Component
Library
Class
Authorization Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Server-side bearer token validation in the MCP Python SDK fails to enforce audience (aud) claims when the authorization server issues tokens for multiple resources, allowing cross-service token acceptance and unauthorized access to the wrong MCP server instance.

Why it matters to the business

Organizations running MCP servers between versions 1.10.0 and 1.30.0 or 2.2.0 risk unauthorized access to protected resources if tokens intended for other services are presented, potentially exposing sensitive data or operations.

How an attack unfolds

An attacker obtains a valid bearer token issued by a shared authorization server for a different resource, presents it to a vulnerable MCP server that does not validate the audience claim, and gains authenticated access equivalent to the token's original scope.

How to fix it

Upgrade the Model Context Protocol Python SDK to version 1.30.0 or 2.2.0 or later. Ensure TokenVerifier implementations explicitly validate the audience claim against the expected resource identifier.

How to confirm the fix worked

Review server logs and configuration for AuthSettings usage, confirm TokenVerifier enforces audience validation, and test token acceptance behavior with tokens containing mismatched audience values after upgrade.

Typical attack path

  1. Obtain a bearer token issued for a different service from the same authorization server
  2. Identify a vulnerable MCP server endpoint accepting bearer tokens via AuthSettings
  3. Submit the token to the target MCP server without audience validation
  4. Receive authenticated session and exercise the token's granted permissions on the unintended server

How to detect it

Examine application logs for successful authentications using bearer tokens where audience claims were not validated; look for patterns of cross-resource token acceptance in MCP server access records.

What your security team should do

  • Immediately audit all MCP server deployments for versions between 1.10.0 and 1.30.0 or 2.2.0
  • Prioritize upgrade to fixed versions 1.30.0 or 2.2.0 within the next maintenance window
  • Implement explicit audience validation in any custom TokenVerifier code
  • Monitor authentication logs for unexpected token usage patterns

The record

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, server-side bearer authentication configured through AuthSettings with token_verifier accepts a valid token issued for another service when the authorization server serves multiple resources and the TokenVerifier does not independently validate the aud audience. This resource-confusion flaw lets a token holder authenticate to the wrong MCP server and exercise that token's resulting access. This issue is fixed in versions 1.30.0 and 2.2.0.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities