MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service (CVE-2026-111771)

In affected MCP TypeScript SDK and server packages, server-side bearer authentication does not verify that the token's audience matches the server, allowing tokens issued for other services by the same authorization server to be accepted. This occurs when using requireBearerAuth() or verifyBearerToken() without an audience check in verifyAccessToken(). The vulnerability affects @modelcontextprotocol/sdk versions 1.6.0 through 1.31.0, @modelcontextprotocol/server 2.0.0 through 2.2.0, @modelcontextprotocol/express 2.0.0 through 2.0.1, and @modelcontextprotocol/server-legacy 2.0.0 through 2.3.0. The fix involves upgrading to versions 1.32.0+ for sdk, 2.3.0+ for server, 2.0.2+ for express, and 2.3.1+ for server-legacy, and enabling the expectedResource audience check by passing the expected audience URL to requireBearerAuth(). Without enabling this setting, the fix does not enforce audience validation. As a workaround, users can reject tokens with unexpected audiences inside verifyAccessToken() on any version.

An attacker with a valid token for another service issued by the same authorization server can gain unauthorized access to the MCP server using the vulnerable SDK, potentially leading to unauthorized access and privilege escalation. The vulnerability impacts confidentiality and integrity by allowing acceptance of tokens not intended for the server. There is no indication of availability impact. The CVSS score is 6.8 (medium severity) with high impact on confidentiality and integrity, requiring low privileges and high attack complexity.

A patch is available in the specified versions: upgrade to @modelcontextprotocol/sdk 1.32.0 or later, @modelcontextprotocol/server 2.3.0 or later, @modelcontextprotocol/express 2.0.2 or later, and @modelcontextprotocol/server-legacy 2.3.1 or later. After upgrading, enable the audience check by passing the expectedResource URL to requireBearerAuth(). Without enabling this setting, the fix does not enforce audience validation. If upgrading is not possible immediately, implement a manual check inside verifyAccessToken() to reject tokens whose aud claim does not include the expected audience. This manual mitigation closes the issue on all versions.