CVE-2026-116684: CVE-2026-116684: Resource-Confusion Authorization Bypass in Model Context Protocol Python SDK

#security #cve #cybersecurity

CVE-2026-116684: Resource-Confusion Authorization Bypass in Model Context Protocol Python SDK

Vulnerability ID: CVE-2026-116684
CVSS Score: 6.8
Published: 2026-10-27

CVE-2026-116684 is an incorrect authorization vulnerability (CWE-863) in the Model Context Protocol (MCP) Python SDK (modelcontextprotocol/python-sdk). The server-side bearer authentication middleware (BearerAuthBackend) verifies token cryptographic signatures and expiration timestamps via TokenVerifier, but fails to verify that the token's audience (aud claim or RFC 8707 resource indicator) matches the receiving MCP server's configured resource_server_url. In multi-service environments sharing a single OAuth 2.0 Authorization Server, an attacker possessing a valid token for an unrelated service can replay it against the MCP server to gain unauthorized access to protected tools, resources, and prompts.

TL;DR

The Model Context Protocol (MCP) Python SDK fails to validate the target audience or RFC 8707 resource indicator of incoming OAuth 2.0 bearer tokens in BearerAuthBackend. Attackers holding valid tokens issued by a shared Identity Provider for unrelated applications can replay those tokens against an MCP server to achieve unauthorized access and execute privileged tools. Upgrading to versions 1.30.0 or 2.2.0 and explicitly enabling validate_token_resource=True in AuthSettings is required to remediate the flaw.

Technical Details

Vulnerability Class: CWE-863: Incorrect Authorization (OAuth 2.0 Audience / Resource Confusion)
Affected Component: mcp.server.auth.middleware.bearer_auth.BearerAuthBackend
Attack Vector: Network (Cross-Service OAuth 2.0 Bearer Token Replay)
CVSS v3.1 Score: 6.8 Medium (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N)
Impact: Unauthorized access to MCP tools, resources, and prompts
Patched Versions: 1.30.0 (v1.x) and 2.2.0 (v2.x) with validate_token_resource=True
Exploit Status: No known public exploits in the wild
CISA KEV Status: Not Listed

Affected Systems

Model Context Protocol Python SDK (mcp) >= 1.10.0, < 1.30.0
Model Context Protocol Python SDK (mcp) >= 2.0.0, < 2.2.0
Model Context Protocol Python SDK (mcp): >= 1.10.0, < 1.30.0 (Fixed in: 1.30.0)
Model Context Protocol Python SDK (mcp): >= 2.0.0, < 2.2.0 (Fixed in: 2.2.0)

Code Analysis

Commit: 0c91368

Add AuthSettings.validate_token_resource to check a bearer token's resource (#3447)

Commit: 8c2fa6e

[v1.x] Add AuthSettings.validate_token_resource to check a bearer token's resource (#3451)

Mitigation Strategies

Upgrade the MCP Python SDK (mcp) to version 1.30.0 (for v1.x) or 2.2.0 (for v2.x) and explicitly enable validate_token_resource=True in AuthSettings.
Enforce strict audience (aud) claim validation directly inside custom TokenVerifier.verify_token() implementations using the underlying JWT library.
Configure distinct, service-specific OAuth 2.0 scopes (e.g., mcp:server_name:access) in AuthSettings.required_scopes so tokens issued for other services lack the scopes required by the MCP server.

Remediation Steps:

Upgrade the mcp dependency via pip (pip install 'mcp>=1.30.0,<2.0.0' for v1.x or pip install 'mcp>=2.2.0' for v2.x).
Locate all declarations of AuthSettings in the MCP server codebase and set validate_token_resource=True alongside a valid resource_server_url.
Audit the TokenVerifier.verify_token() implementation to confirm that it extracts the aud claim or RFC 8707 resource indicator from the token and assigns it to the resource field of the returned AccessToken instance.
Monitor application startup logs to ensure no MCPDeprecationWarning regarding AuthSettings.validate_token_resource is emitted.

References

Read the full report for CVE-2026-116684 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community