{"id":"GHSA-rvq5-wwqv-78pq","summary":"MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service","details":"### Summary\nIn affected versions, the SDK's server-side bearer authentication had no way to check that a token was issued for your server (its audience). Where one authorization server issues tokens for several services, a valid token for another service was also accepted by your MCP server.\n\n### Am I affected?\nYes, if your HTTP server uses `requireBearerAuth()` or `verifyBearerToken()`, its authorization server also issues tokens for other services, and your `verifyAccessToken()` does not check the token's audience (`aud`) itself.\n\nAffected versions:\n\n- `@modelcontextprotocol/sdk` 1.6.0 through 1.31.0\n- `@modelcontextprotocol/server` 2.0.0 through 2.2.0\n- `@modelcontextprotocol/express` 2.0.0 through 2.0.1\n- `@modelcontextprotocol/server-legacy` 2.0.0 through 2.3.0\n\n### Fix\nUpgrade to:\n\n- 1.x: `@modelcontextprotocol/sdk` 1.32.0 or later\n- 2.x: `@modelcontextprotocol/server` 2.3.0 or later, together with `@modelcontextprotocol/express` 2.0.2 or later if you use it\n- `@modelcontextprotocol/server-legacy` 2.3.1 or later\n\n**Upgrading alone changes nothing.** The patched versions add an `expectedResource` setting that is off by default. To turn the check on, make both of these changes together:\n\n1. Pass the audience your authorization server puts in tokens for your server: `requireBearerAuth({ verifier, expectedResource: new URL('https://mcp.example.com/mcp') })`.\n2. Return the token's audience from `verifyAccessToken()` as `AuthInfo.resource`, also a `URL`.\n\nA token for another service then gets `401`. With only the first change, every request gets `401`.\n\nIf you cannot upgrade yet, reject any token whose `aud` does not include your server inside `verifyAccessToken()`. That closes the issue on every version.","aliases":["CVE-2026-111771"],"modified":"2026-10-20T20:00:04.595309934Z","published":"2026-10-20T19:43:36Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-10-20T19:43:36Z","nvd_published_at":null,"cwe_ids":["CWE-863"],"severity":"MODERATE"},"references":[{"type":"WEB","url":"https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-rvq5-wwqv-78pq"},{"type":"WEB","url":"https://github.com/modelcontextprotocol/typescript-sdk/commit/40f8f4e229d963cd7fd2890bda2aeebe7005299a"},{"type":"WEB","url":"https://github.com/modelcontextprotocol/typescript-sdk/commit/5a0724d14cf34a27a3b070224d2996cdd611df9f"},{"type":"WEB","url":"https://github.com/modelcontextprotocol/typescript-sdk/commit/5a1867390b91b8836f49af76c45427279f513325"},{"type":"PACKAGE","url":"https://github.com/modelcontextprotocol/typescript-sdk"}],"affected":[{"package":{"name":"@modelcontextprotocol/sdk","ecosystem":"npm","purl":"pkg:npm/%40modelcontextprotocol/sdk"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.6.0"},{"fixed":"1.32.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-rvq5-wwqv-78pq/GHSA-rvq5-wwqv-78pq.json"}},{"package":{"name":"@modelcontextprotocol/server","ecosystem":"npm","purl":"pkg:npm/%40modelcontextprotocol/server"},"ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.3.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-rvq5-wwqv-78pq/GHSA-rvq5-wwqv-78pq.json"}},{"package":{"name":"@modelcontextprotocol/express","ecosystem":"npm","purl":"pkg:npm/%40modelcontextprotocol/express"},"ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.0.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-rvq5-wwqv-78pq/GHSA-rvq5-wwqv-78pq.json"}},{"package":{"name":"@modelcontextprotocol/server-legacy","ecosystem":"npm","purl":"pkg:npm/%40modelcontextprotocol/server-legacy"},"ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.3.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-rvq5-wwqv-78pq/GHSA-rvq5-wwqv-78pq.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N"}]}