CVE-2026-116684

Name of the Vulnerable Software and Affected Versions Model Context Protocol Python SDK versions 1.10.0 through 1.29.1 Model Context Protocol Python SDK versions 2.0.0 through 2.1.1

Description Server-side bearer authentication configured through AuthSettings with token verifier fails to independently validate the aud audience. In environments where a single authorization server issues tokens for multiple resources, this resource-confusion flaw allows a token holder to authenticate to an incorrect MCP server and exercise the access associated with that token.

Recommendations For versions 1.10.0 through 1.29.1, upgrade to version 1.30.0 or later, set validate token resource=True in AuthSettings with the resource server url configured to the correct audience, and return the token's audience from verify token() as AccessToken.resource. For versions 2.0.0 through 2.1.1, upgrade to version 2.2.0 or later, set validate token resource=True in AuthSettings with the resource server url configured to the correct audience, and return the token's audience from verify token() as AccessToken.resource. As a temporary workaround for all affected versions, reject any token whose aud does not include the server inside the verify token() function.