{"id":"CVE-2026-116684","aliases":["GHSA-w4fh-qvv9-3v23"],"title":"Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server","titleSource":"GitHub_M","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"### Summary\nIn affected versions, the SDK's server-side bearer authentication had no way to check that a token was issued for your server (its audience). Where one authorization server issues tokens for several services, a valid token for another service was also accepted by your MCP server.\n\n### Am I affected?\nYes, if your HTTP server uses the SDK's bearer authentication (`auth=AuthSettings(...)` with `token_verifier=`), its authorization server also issues tokens for other services, and your `TokenVerifier` does not check the token's audience (`aud`) itself.\n\nAffected versions:\n\n- `mcp` 1.10.0 through 1.29.1\n- `mcp` 2.0.0 through 2.1.1\n\n### Fix\nUpgrade to:\n\n- 1.x: `mcp` 1.30.0 or later\n- 2.x: `mcp` 2.2.0 or later\n\n**Upgrading alone changes nothing.** The patched versions add a `validate_token_resource` setting that is off unless you set it. To turn the check on, make both of these changes together:\n\n1. Set `validate_token_resource=True` in `AuthSettings`, with `resource_server_url` set to the audience your authorization server puts in tokens for your server.\n2. Return the token's audience from `verify_token()` as `AccessToken.resource`.\n\nA token for another service then gets `401`. With only the first change, every request gets `401`.\n\nIf your `TokenVerifier` already checks the audience, set `validate_token_resource=False` to silence the deprecation warning. The setting will default to `True` in 3.0.\n\nIf you cannot upgrade yet, reject any token whose `aud` does not include your server inside `verify_token()`. That closes the issue on every version.","severity":"medium","score":6.8,"published":"2026-10-27T19:12:24.255Z","modified":"2026-10-27T21:15:03.825Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"PyPI","name":"mcp","sources":[{"name":"OSV · GHSA-w4fh-qvv9-3v23","url":"https://osv.dev/vulnerability/GHSA-w4fh-qvv9-3v23"}],"ranges":[{"events":[{"introduced":"2.0.0"},{"fixed":"2.2.0"}],"type":"ECOSYSTEM"}],"versions":["2.0.0","2.0.1","2.1.0","2.1.1"],"fixed":["2.2.0"]},{"ecosystem":"PyPI","name":"mcp","sources":[{"name":"OSV · GHSA-w4fh-qvv9-3v23","url":"https://osv.dev/vulnerability/GHSA-w4fh-qvv9-3v23"}],"ranges":[{"events":[{"introduced":"1.10.0"},{"fixed":"1.30.0"}],"type":"ECOSYSTEM"}],"versions":["1.10.0","1.10.1","1.11.0","1.12.0","1.12.1","1.12.2","1.12.3","1.12.4","1.13.0","1.13.1","1.14.0","1.14.1","1.15.0","1.16.0","1.17.0","1.18.0","1.19.0","1.20.0","1.21.0","1.21.1","1.21.2","1.22.0","1.23.0","1.23.1","1.23.2","1.23.3","1.24.0","1.25.0","1.26.0","1.27.0","1.27.1","1.27.2","1.28.0","1.28.1","1.29.0","1.29.1"],"fixed":["1.30.0"]}],"sourceAffected":[],"references":["https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-w4fh-qvv9-3v23","https://github.com/modelcontextprotocol/python-sdk/pull/3447","https://github.com/modelcontextprotocol/python-sdk/pull/3451","https://github.com/modelcontextprotocol/python-sdk/commit/0c9136841ff092987a20700ff9c2c9789bda2f40","https://github.com/modelcontextprotocol/python-sdk/commit/8c2fa6eabacde869d75568e33b9d466b58c2f512","https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.30.0","https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.2.0","https://github.com/modelcontextprotocol/python-sdk"],"sources":[{"name":"CVE","id":"CVE-2026-116684","modified":"2026-10-27T19:12:24.255Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-116684"},{"name":"OSV","id":"GHSA-w4fh-qvv9-3v23","modified":"2026-10-27T21:15:03.825987077Z","url":"https://osv.dev/vulnerability/GHSA-w4fh-qvv9-3v23"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","score":6.8},{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","score":6.8}],"products":[{"vendor":"modelcontextprotocol","name":"python-sdk","platforms":[],"versions":[{"version":">= 1.10.0, < 1.30.0","status":"affected"},{"version":">= 2.0.0, < 2.2.0","status":"affected"}],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-116684"}],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T09:05:33.113Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}