{"id":"CVE-2026-111771","aliases":["GHSA-rvq5-wwqv-78pq"],"title":"MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service","summary":"MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service","severity":"medium","cvss":6.8,"cwe":["CWE-863"],"vendor":"modelcontextprotocol","product":"@modelcontextprotocol/sdk","ecosystem":"npm","affected":["@modelcontextprotocol/sdk >= 1.6.0, < 1.32.0","@modelcontextprotocol/server >= 2.0.0, < 2.3.0","@modelcontextprotocol/express >= 2.0.0, < 2.0.2","@modelcontextprotocol/server-legacy >= 2.0.0, < 2.3.1"],"patched":["@modelcontextprotocol/sdk 1.32.0","@modelcontextprotocol/server 2.3.0","@modelcontextprotocol/express 2.0.2","@modelcontextprotocol/server-legacy 2.3.1"],"published":"2026-10-20","updated":"2026-10-20","sourceUpdated":"2026-10-20T19:43:37Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-rvq5-wwqv-78pq","references":[{"url":"https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-rvq5-wwqv-78pq"},{"url":"https://github.com/modelcontextprotocol/typescript-sdk/commit/40f8f4e229d963cd7fd2890bda2aeebe7005299a"},{"url":"https://github.com/modelcontextprotocol/typescript-sdk/commit/5a0724d14cf34a27a3b070224d2996cdd611df9f"},{"url":"https://github.com/modelcontextprotocol/typescript-sdk/commit/5a1867390b91b8836f49af76c45427279f513325"},{"url":"https://github.com/advisories/GHSA-rvq5-wwqv-78pq"}],"tags":["ghsa","npm"],"ingestedAt":"2026-10-20T20:18:14.524Z","slug":"CVE-2026-111771","body":"## Overview\n\n### Summary\nIn affected versions, the SDK's server-side bearer authentication had no way to check that a token was issued for your server (its audience). Where one authorization server issues tokens for several services, a valid token for another service was also accepted by your MCP server.\n\n### Am I affected?\nYes, if your HTTP server uses `requireBearerAuth()` or `verifyBearerToken()`, its authorization server also issues tokens for other services, and your `verifyAccessToken()` does not check the token's audience (`aud`) itself.\n\nAffected versions:\n\n- `@modelcontextprotocol/sdk` 1.6.0 through 1.31.0\n- `@modelcontextprotocol/server` 2.0.0 through 2.2.0\n- `@modelcontextprotocol/express` 2.0.0 through 2.0.1\n- `@modelcontextprotocol/server-legacy` 2.0.0 through 2.3.0\n\n### Fix\nUpgrade to:\n\n- 1.x: `@modelcontextprotocol/sdk` 1.32.0 or later\n- 2.x: `@modelcontextprotocol/server` 2.3.0 or later, together with `@modelcontextprotocol/express` 2.0.2 or later if you use it\n- `@modelcontextprotocol/server-legacy` 2.3.1 or later\n\n**Upgrading alone changes nothing.** The patched versions add an `expectedResource` setting that is off by default. To turn the check on, make both of these changes together:\n\n1. Pass the audience your authorization server puts in tokens for your server: `requireBearerAuth({ verifier, expectedResource: new URL('https://mcp.example.com/mcp') })`.\n2. Return the token's audience from `verifyAccessToken()` as `AuthInfo.resource`, also a `URL`.\n\nA token for another service then gets `401`. With only the first change, every request gets `401`.\n\nIf you cannot upgrade yet, reject any token whose `aud` does not include your server inside `verifyAccessToken()`. That closes the issue on every version.\n\n## Affected packages\n\n- `@modelcontextprotocol/sdk >= 1.6.0, < 1.32.0`\n- `@modelcontextprotocol/server >= 2.0.0, < 2.3.0`\n- `@modelcontextprotocol/express >= 2.0.0, < 2.0.2`\n- `@modelcontextprotocol/server-legacy >= 2.0.0, < 2.3.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `@modelcontextprotocol/sdk 1.32.0`\n- `@modelcontextprotocol/server 2.3.0`\n- `@modelcontextprotocol/express 2.0.2`\n- `@modelcontextprotocol/server-legacy 2.3.1`","depth":"sunlit","depthScore":37,"depthScoreParts":{"impact":37.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}