{"id":"CVE-2026-116684","summary":"Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server","details":"The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, server-side bearer authentication configured through AuthSettings with token_verifier accepts a valid token issued for another service when the authorization server serves multiple resources and the TokenVerifier does not independently validate the aud audience. This resource-confusion flaw lets a token holder authenticate to the wrong MCP server and exercise that token's resulting access. This issue is fixed in versions 1.30.0 and 2.2.0.","aliases":["GHSA-w4fh-qvv9-3v23"],"modified":"2026-10-28T02:54:49.951978440Z","published":"2026-10-27T19:12:24.255Z","database_specific":{"cwe_ids":["CWE-863"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116684.json","cna_assigner":"GitHub_M"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116684.json"},{"type":"FIX","url":"https://github.com/modelcontextprotocol/python-sdk/commit/0c9136841ff092987a20700ff9c2c9789bda2f40"},{"type":"FIX","url":"https://github.com/modelcontextprotocol/python-sdk/commit/8c2fa6eabacde869d75568e33b9d466b58c2f512"},{"type":"FIX","url":"https://github.com/modelcontextprotocol/python-sdk/pull/3447"},{"type":"FIX","url":"https://github.com/modelcontextprotocol/python-sdk/pull/3451"},{"type":"WEB","url":"https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.30.0"},{"type":"WEB","url":"https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.2.0"},{"type":"ADVISORY","url":"https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-w4fh-qvv9-3v23"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116684"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/modelcontextprotocol/python-sdk","events":[{"introduced":"dced22344d80d85884df9c26281fdfe0331e9c65"},{"fixed":"8c2fa6eabacde869d75568e33b9d466b58c2f512"},{"introduced":"6f69a3758ebf2ee55ce050f58b470ce11af71133"},{"fixed":"9972c21aa42054fb1450c5fc614761ed11847ec6"},{"fixed":"0c9136841ff092987a20700ff9c2c9789bda2f40"}],"database_specific":{"extracted_events":[{"strategy":"StringRangeExpression","range":[{"introduced":"1.10.0"},{"fixed":"1.30.0"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"2.0.0"},{"fixed":"2.2.0"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"range":[{"fixed":"0c9136841ff092987a20700ff9c2c9789bda2f40"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"8c2fa6eabacde869d75568e33b9d466b58c2f512"}],"source":"REFERENCES_COMMIT"},{"original_tag":"v1.30.0","range":[{"fixed":"8c2fa6eabacde869d75568e33b9d466b58c2f512"}],"source":"REFERENCES_TAG"},{"source":"REFERENCES_TAG","original_tag":"v2.2.0","range":[{"fixed":"9972c21aa42054fb1450c5fc614761ed11847ec6"}]}]}}],"versions":["v1.29.1","v2.1.1","v2.0.0","v2.1.0","v1.29.0","v1.28.1","v1.28.0","v1.27.2","v1.27.1","v1.27.0","v1.26.0","v1.25.0","v1.24.0","v1.23.3","v1.23.2","v1.23.1","v1.23.0","v1.22.0","v1.21.1","v1.21.0","v1.20.0","v1.19.0","v1.18.0","v1.17.0","v1.16.0","v1.15.0","1.15.0","v1.14.1","v1.14.0","v1.13.1","v1.13.0","v1.12.4","v1.12.3","v1.12.2","v1.12.1","v1.12.0","v1.11.0","v1.10.1","v1.10.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-116684.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N"}]}