CVE-2026-111771

Name of the Vulnerable Software and Affected Versions @modelcontextprotocol/sdk versions 1.6.0 through 1.31.0 @modelcontextprotocol/server versions 2.0.0 through 2.2.0 @modelcontextprotocol/express versions 2.0.0 through 2.0.1 @modelcontextprotocol/server-legacy versions 2.0.0 through 2.3.0

Description Remote Model Context Protocol servers are susceptible to cross-service bearer token replay. This occurs because the server-side bearer authentication fails to validate the audience (aud) of the token. In environments where a single authorization server issues tokens for multiple services, a token intended for a different service may be incorrectly accepted by the MCP server. This issue affects servers utilizing the requireBearerAuth() or verifyBearerToken() functions if the verifyAccessToken() function does not independently validate the aud claim.

Recommendations For @modelcontextprotocol/sdk, upgrade to version 1.32.0 or later. For @modelcontextprotocol/server, upgrade to version 2.3.0 or later. For @modelcontextprotocol/express, upgrade to version 2.0.2 or later. For @modelcontextprotocol/server-legacy, upgrade to version 2.3.1 or later. When upgrading, configure the expectedResource setting by passing the server's audience URL to requireBearerAuth() and returning the token's audience as AuthInfo.resource (as a URL) from verifyAccessToken(). As a temporary workaround for all affected versions, manually reject any token within the verifyAccessToken() function if its aud claim does not include the server.