CVE-2026-111771— Model Context Protocol TypeScript SDK: Server bearer authentication accepted tokens issued for another service

Quick assessment

Affected

modelcontextprotocol typescript-sdk

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Model Context Protocol（MCP）TypeScript SDK 提供了 MCP 协议的 TypeScript 客户端和服务端实现。在以下版本范围内存在安全漏洞：：从 1.6.0 到 1.32.0（不含 1.32.0）：从 2.0.0 到 2.3.0（不含 2.3.0）：从 2.0.0 到 2.0.2（不含 2.0.2）：从 2.0.0 到 2.3.1（不含 2.3.1）由于 SDK 未对令牌（token）的受众（audience）进行强制校验，服务端在验证 HTTP Bearer 认证

CVSS 6.8 · Medium Updated Nov 06, 2026

Possible ATT&CK Techniques 2 AI

T1078 · Valid Accounts T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Model Context Protocol TypeScript SDK: Server bearer authentication accepted tokens issued for another service

Source: CVE Program / CVE List V5

Vulnerability Description

The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 1.6.0 until 1.32.0 in @modelcontextprotocol/sdk, from 2.0.0 until 2.3.0 in @modelcontextprotocol/server, from 2.0.0 until 2.0.2 in @modelcontextprotocol/express, and from 2.0.0 until 2.3.1 in @modelcontextprotocol/server-legacy, server-side bearer authentication could accept a valid access token issued for a different service because the SDK did not enforce the token audience. The affected surface is server-side HTTP bearer authentication. The trigger is a valid token whose audience names another service. The authorization server must issue tokens for multiple services, and the application's verifyAccessToken() must not independently validate aud. Applications already validating aud inside verifyAccessToken() are not affected. An attacker with a token for another service could authenticate to the MCP server and obtain the confidentiality and integrity capabilities granted to an authenticated caller. Upgrading alone leaves the new audience validation disabled. Operators must enable audience validation and provide the token audience together. Enabling only the expected audience check causes every request to receive HTTP 401. This issue is fixed in @modelcontextprotocol/sdk 1.32.0, @modelcontextprotocol/server 2.3.0, @modelcontextprotocol/express 2.0.2, and @modelcontextprotocol/server-legacy 2.3.1.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制不正确

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE
modelcontextprotocol	typescript-sdk	>= 1.6.0, < 1.32.0	-
@modelcontextprotocol	sdk	>= 1.6.0, < 1.32.0	-
@modelcontextprotocol	server	>= 2.0.0, < 2.3.0	-
@modelcontextprotocol	express	>= 2.0.0, < 2.0.2	-
@modelcontextprotocol	server-legacy	>= 2.0.0, < 2.3.1	-

II. Public POCs for CVE-2026-111771

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-111771

请登录查看更多情报信息。

Other References for CVE-2026-111771 (11)

https://github.com/modelcontextprotocol/typescript-sdk/pull/2952 x_refsource_MISC
https://github.com/modelcontextprotocol/typescript-sdk/pull/2929 x_refsource_MISC
https://github.com/modelcontextprotocol/typescript-sdk/pull/2930 x_refsource_MISC
https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.32.0 x_refsource_MISC
https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-rvq5-wwqv-78pq x_refsource_CONFIRM
https://github.com/modelcontextprotocol/typescript-sdk/commit/5a0724d14cf34a27a3b070224d2996cdd611df9f x_refsource_MISC
https://github.com/modelcontextprotocol/typescript-sdk/commit/40f8f4e229d963cd7fd2890bda2aeebe7005299a x_refsource_MISC
https://github.com/modelcontextprotocol/typescript-sdk/commit/5a1867390b91b8836f49af76c45427279f513325 x_refsource_MISC
https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/server@2.3.0 x_refsource_MISC
https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/express@2.0.2 x_refsource_MISC
https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/server-legacy@2.3.1 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-111771

Same Patch Batch · modelcontextprotocol · 2026-11-05 · 4 CVEs total

CVE-2026-111770	7.7 HIGH	Model Context Protocol TypeScript SDK: Shared transport or server instances delivered one
CVE-2026-111768	7.5 HIGH	Model Context Protocol TypeScript SDK: One HTTP request within the default size limit coul
CVE-2026-111769	6.5 MEDIUM	Model Context Protocol TypeScript SDK: HTTP client transports and OAuth requests followed

IV. Related Vulnerabilities

Same product: typescript-sdk

Same vendor: modelcontextprotocol

Same weakness: CWE-863