{"id":"GHSA-rvq5-wwqv-78pq","revision":"07d51d5b53514c29bbee12095e79d8bc","records":[{"revision":"07d51d5b53514c29bbee12095e79d8bc","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-rvq5-wwqv-78pq","aliases":["CVE-2026-111771"],"title":"MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service","description":"### Summary\nIn affected versions, the SDK's server-side bearer authentication had no way to check that a token was issued for your server (its audience). Where one authorization server issues tokens for several services, a valid token for another service was also accepted by your MCP server.\n\n### Am I affected?\nYes, if your HTTP server uses `requireBearerAuth()` or `verifyBearerToken()`, its authorization server also issues tokens for other services, and your `verifyAccessToken()` does not check the token's audience (`aud`) itself.\n\nAffected versions:\n\n- `@modelcontextprotocol/sdk` 1.6.0 through 1.31.0\n- `@modelcontextprotocol/server` 2.0.0 through 2.2.0\n- `@modelcontextprotocol/express` 2.0.0 through 2.0.1\n- `@modelcontextprotocol/server-legacy` 2.0.0 through 2.3.0\n\n### Fix\nUpgrade to:\n\n- 1.x: `@modelcontextprotocol/sdk` 1.32.0 or later\n- 2.x: `@modelcontextprotocol/server` 2.3.0 or later, together with `@modelcontextprotocol/express` 2.0.2 or later if you use it\n- `@modelcontextprotocol/server-legacy` 2.3.1 or later\n\n**Upgrading alone changes nothing.** The patched versions add an `expectedResource` setting that is off by default. To turn the check on, make both of these changes together:\n\n1. Pass the audience your authorization server puts in tokens for your server: `requireBearerAuth({ verifier, expectedResource: new URL('https://mcp.example.com/mcp') })`.\n2. Return the token's audience from `verifyAccessToken()` as `AuthInfo.resource`, also a `URL`.\n\nA token for another service then gets `401`. With only the first change, every request gets `401`.\n\nIf you cannot upgrade yet, reject any token whose `aud` does not include your server inside `verifyAccessToken()`. That closes the issue on every version.","state":0,"publishedAt":"2026-10-20T19:43:36+00:00","modifiedAt":"2026-10-20T20:00:04.5953099+00:00","affected":[{"ecosystem":"npm","name":"@modelcontextprotocol/sdk","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.6.0"},{"kind":"fixed","version":"1.32.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@modelcontextprotocol/server","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.0.0"},{"kind":"fixed","version":"2.3.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@modelcontextprotocol/express","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.0.0"},{"kind":"fixed","version":"2.0.2"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@modelcontextprotocol/server-legacy","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.0.0"},{"kind":"fixed","version":"2.3.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-rvq5-wwqv-78pq","https://github.com/modelcontextprotocol/typescript-sdk/commit/40f8f4e229d963cd7fd2890bda2aeebe7005299a","https://github.com/modelcontextprotocol/typescript-sdk/commit/5a0724d14cf34a27a3b070224d2996cdd611df9f","https://github.com/modelcontextprotocol/typescript-sdk/commit/5a1867390b91b8836f49af76c45427279f513325","https://github.com/modelcontextprotocol/typescript-sdk"],"sourceUrl":"https://github.com/advisories/GHSA-rvq5-wwqv-78pq","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-rvq5-wwqv-78pq","identifiers":["GHSA-rvq5-wwqv-78pq","CVE-2026-111771"]},"retained":false,"historicalAffected":[]}],"coverage":[]}