{"id":"CVE-2026-116684","kind":"vulnerability","aliases":["CVE-2026-116684","GHSA-w4fh-qvv9-3v23"],"related":[],"title":"Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server","description":"### Summary\nIn affected versions, the SDK's server-side bearer authentication had no way to check that a token was issued for your server (its audience). Where one authorization server issues tokens for several services, a valid token for another service was also accepted by your MCP server.\n\n### Am I affected?\nYes, if your HTTP server uses the SDK's bearer authentication (`auth=AuthSettings(...)` with `token_verifier=`), its authorization server also issues tokens for other services, and your `TokenVerifier` does not check the token's audience (`aud`) itself.\n\nAffected versions:\n\n- `mcp` 1.10.0 through 1.29.1\n- `mcp` 2.0.0 through 2.1.1\n\n### Fix\nUpgrade to:\n\n- 1.x: `mcp` 1.30.0 or later\n- 2.x: `mcp` 2.2.0 or later\n\n**Upgrading alone changes nothing.** The patched versions add a `validate_token_resource` setting that is off unless you set it. To turn the check on, make both of these changes together:\n\n1. Set `validate_token_resource=True` in `AuthSettings`, with `resource_server_url` set to the audience your authorization server puts in tokens for your server.\n2. Return the token's audience from `verify_token()` as `AccessToken.resource`.\n\nA token for another service then gets `401`. With only the first change, every request gets `401`.\n\nIf your `TokenVerifier` already checks the audience, set `validate_token_resource=False` to silence the deprecation warning. The setting will default to `True` in 3.0.\n\nIf you cannot upgrade yet, reject any token whose `aud` does not include your server inside `verify_token()`. That closes the issue on every version.","summary":"The official Model Context Protocol Python SDK's bearer authentication accepts a valid token issued for a different service when the token verifier does not check the aud audience claim. A token holder can authenticate to the wrong MCP server and use the access that token grants there.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"mcp","fixed":["2.2.0"],"affected":">= 2.0.0, < 2.2.0","ecosystem":"pypi"},{"name":"mcp","fixed":["1.30.0"],"affected":">= 1.10.0, < 1.30.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["ai-tooling","cwe-863","mcp","python","self-hosted"],"not_affected_if":["default-config","no-bearer-auth"],"how_to_check":"- Check the installed SDK version with `pip show mcp` and look for versions from `1.10.0` up to before `1.30.0`, or `2.0.0` through `2.1.x`.\n- Search the server code for `AuthSettings` and `token_verifier` and confirm the verifier validates the `aud` claim.","fix":"- Upgrade the `mcp` Python package to `1.30.0` or `2.2.0`, matching your major version.\n- Make your `token_verifier` validate that the token's `aud` claim matches this MCP server.","status":"open","published_at":"2026-10-27T20:17:13+00:00","first_seen_at":"2026-10-27T20:33:27+00:00","triaged_at":"2026-10-27T20:35:30+00:00","updated_at":"2026-10-27T21:09:20+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-27T20:35:30Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the `mcp` Python package to `1.30.0` or `2.2.0`, matching your major version.\n- Make your `token_verifier` validate that the token's `aud` claim matches this MCP server.","reach":"network","title":"MCP Python SDK: bearer tokens for other services accepted by MCP servers","impact":"medium","summary":"The official Model Context Protocol Python SDK's bearer authentication accepts a valid token issued for a different service when the token verifier does not check the aud audience claim. A token holder can authenticate to the wrong MCP server and use the access that token grants there.","category":"ai-tooling","nicknames":[],"who_cares":["mcp","python","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"a token issued for another service grants access to this MCP server","analyst_note":"","how_to_check":"- Check the installed SDK version with `pip show mcp` and look for versions from `1.10.0` up to before `1.30.0`, or `2.0.0` through `2.1.x`.\n- Search the server code for `AuthSettings` and `token_verifier` and confirm the verifier validates the `aud` claim.","needs_analyst":false,"not_affected_if":["default-config","no-bearer-auth"],"who_is_affected":"Teams running an MCP server built on the Python SDK with `AuthSettings` and a custom `token_verifier` that accepts bearer tokens, especially where the authorization server issues tokens for multiple resources. Servers that do not use bearer authentication through this path, or that already validate `aud` in their verifier, are not exposed by this flaw.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000639,"input_tokens":3413,"output_tokens":595,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116684':21A,29A '-2026':20A,28A '-863':36B '1':191C,234C '1.10.0':181C '1.29.1':183C '1.30.0':194C '2':197C,259C '2.0.0':185C '2.1.1':187C '2.2.0':200C '3.0':311C '3v23':26A '401':277C,286C 'accept':11A,52B,133C 'access':85B 'accesstoken.resource':269C 'add':210C 'affect':91C,140C,178C 'ai':33B 'ai-tool':32B 'alon':204C 'alreadi':290C 'also':132C,160C 'anoth':129C,273C 'aud':69B,176C,321C 'audienc':70B,115C,175C,249C,264C,293C 'auth':152C 'authent':10A,51B,76B,100C,151C 'author':118C,158C,251C 'authset':153C,241C 'bearer':8A,50B,99C,150C 'bearer-token':7A 'cannot':314C 'chang':205C,232C,282C 'check':67B,105C,171C,226C,291C 'claim':71B 'close':331C 'context':2A,45B 'cve':19A,27A 'cwe':35B 'default':307C 'deprec':302C 'differ':16A,59B 'everi':283C,335C 'fals':298C 'first':281C 'fix':188C 'get':276C,285C 'ghsa':23A 'ghsa-w4fh-qvv9-3v23':22A 'grant':88B 'holder':74B 'host':41B 'http':144C 'includ':324C 'insid':327C 'issu':13A,56B,110C,120C,161C,333C 'later':196C,202C 'make':228C 'mcp':30A,31A,37B,80B,136C,180C,184C,193C,199C 'model':1A,44B 'noth':206C 'offici':43B 'one':117C 'patch':208C 'protocol':3A,46B 'put':253C 'python':4A,38B,47B 'qvv9':25A 'reject':317C 'request':284C 'resourc':17A,214C,238C,243C,297C 'return':260C 'sdk':5A,48B,94C,148C 'self':40B 'self-host':39B 'server':6A,18A,81B,97C,113C,119C,137C,145C,159C,244C,252C,258C,326C 'server-sid':96C 'servic':60B,124C,130C,165C,274C 'set':215C,221C,235C,246C,294C,305C 'sever':123C 'side':98C 'silenc':300C 'summari':89C 'togeth':233C 'token':9A,12A,55B,63B,73B,87B,108C,121C,127C,155C,162C,173C,213C,237C,255C,262C,267C,271C,296C,319C,329C 'tokenverifi':168C,289C 'tool':34B 'true':239C,309C 'turn':224C 'unless':219C 'upgrad':189C,203C,315C 'url':245C 'use':83B,146C 'valid':54B,126C,212C,236C,295C 'verifi':64B,156C,266C,328C 'version':92C,179C,209C,336C 'w4fh':24A 'warn':303C 'way':103C 'whose':320C 'wrong':79B 'x':192C,198C 'yes':141C 'yet':316C","nicknames":[],"mitigations":[],"who_affected":"Teams running an MCP server built on the Python SDK with `AuthSettings` and a custom `token_verifier` that accepts bearer tokens, especially where the authorization server issues tokens for multiple resources. Servers that do not use bearer authentication through this path, or that already validate `aud` in their verifier, are not exposed by this flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T20:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116684","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116684","severity":null,"published_at":"2026-10-27T20:17:13+00:00","modified_at":"2026-10-27T20:17:13+00:00","first_seen_at":"2026-10-27T20:33:27+00:00","fetched_at":"2026-10-27T20:33:27+00:00","note":null},{"source":"ghsa","external_id":"GHSA-w4fh-qvv9-3v23","url":"https://github.com/advisories/GHSA-w4fh-qvv9-3v23","severity":"medium","published_at":"2026-10-27T21:06:59+00:00","modified_at":"2026-10-27T21:07:01+00:00","first_seen_at":"2026-10-27T21:09:20+00:00","fetched_at":"2026-10-27T21:09:20+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}