Server-Side Bearer Authentication Flaw in Model Context Protocol SDK by Model Context Protocol
CVE-2026-111771
What is CVE-2026-111771?
A vulnerability exists in the Model Context Protocol TypeScript SDK components, where server-side bearer authentication fails to enforce proper audience validation for access tokens. Tokens issued for one service could be mistakenly accepted by another, allowing unauthorized access. To mitigate this risk, applications must implement audience validation during the verifyAccessToken() process. Without these measures, attackers with a valid token from a different service could gain unauthorized access to sensitive functionalities. Upgrading to the specified versions alone does not resolve the issue; operators must ensure that audience validation is activated correctly to protect their applications.
Affected Version(s)
express >= 2.0.0, < 2.0.2
sdk >= 1.6.0, < 1.32.0
server >= 2.0.0, < 2.3.0