{"id":"GO-2026-5273","revision":"d601372a791e4e508ef95408a23b06b9","records":[{"revision":"d601372a791e4e508ef95408a23b06b9","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5273","aliases":["CVE-2026-44428","GHSA-95c3-6vvw-4mrq"],"title":"MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry","description":"MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience in github.com/modelcontextprotocol/registry","state":0,"publishedAt":"2026-06-25T18:43:15+00:00","modifiedAt":"2026-06-25T19:45:24.9504671+00:00","affected":[{"ecosystem":"Go","name":"github.com/modelcontextprotocol/registry","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.7.6"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/modelcontextprotocol/registry/security/advisories/GHSA-95c3-6vvw-4mrq","https://nvd.nist.gov/vuln/detail/CVE-2026-44428","https://github.com/modelcontextprotocol/registry/commit/3f89fc2b1fb34fd49f3c0e1b39e964a5c67b613f","https://github.com/modelcontextprotocol/registry/pull/1229","https://github.com/modelcontextprotocol/registry/releases/tag/v1.7.6"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5273","license":"OSV · upstream source license applies","key":"osv:GO-2026-5273","identifiers":["GO-2026-5273","CVE-2026-44428","GHSA-95c3-6vvw-4mrq"]},"retained":false,"historicalAffected":[]}],"coverage":[]}