{"schema":"threatline.record/2","record":{"id":"CVE-2026-111771","aliases":["GHSA-rvq5-wwqv-78pq"],"summary":"MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service","details":"### Summary\nIn affected versions, the SDK's server-side bearer authentication had no way to check that a token was issued for your server (its audience). Where one authorization server issues tokens for several services, a valid token for another service was also accepted by your MCP server.\n\n### Am I affected?\nYes, if your HTTP server uses `requireBearerAuth()` or `verifyBearerToken()`, its authorization server also issues tokens for other services, and your `verifyAccessToken()` does not check the token's audience (`aud`) itself.\n\nAffected versions:\n\n- `@modelcontextprotocol/sdk` 1.6.0 through 1.31.0\n- `@modelcontextprotocol/server` 2.0.0 through 2.2.0\n- `@modelcontextprotocol/express` 2.0.0 through 2.0.1\n- `@modelcontextprotocol/server-legacy` 2.0.0 through 2.3.0\n\n### Fix\nUpgrade to:\n\n- 1.x: `@modelcontextprotocol/sdk` 1.32.0 or later\n- 2.x: `@modelcontextprotocol/server` 2.3.0 or later, together with `@modelcontextprotocol/express` 2.0.2 or later if you use it\n- `@modelcontextprotocol/server-legacy` 2.3.1 or later\n\n**Upgrading alone changes nothing.** The patched versions add an `expectedResource` setting that is off by default. To turn the check on, make both of these changes together:\n\n1. Pass the audience your authorization server puts in tokens for your server: `requireBearerAuth({ verifier, expectedResource: new URL('https://mcp.example.com/mcp') })`.\n2. Return the token's audience from `verifyAccessToken()` as `AuthInfo.resource`, also a `URL`.\n\nA token for another service then gets `401`. With only the first change, every request gets `401`.\n\nIf you cannot upgrade yet, reject any token whose `aud` does not include your server inside `verifyAccessToken()`. That closes the issue on every version.","categories":["Libraries & packages"],"product":"@modelcontextprotocol/sdk","vendor":"","ecosystem":"npm","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-rvq5-wwqv-78pq","source_modified_at":"2026-10-20T19:43:37Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"@modelcontextprotocol/sdk"},"range":">= 1.6.0, < 1.32.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-rvq5-wwqv-78pq","source_modified_at":"2026-10-20T19:43:37Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"@modelcontextprotocol/server"},"range":">= 2.0.0, < 2.3.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-rvq5-wwqv-78pq","source_modified_at":"2026-10-20T19:43:37Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"@modelcontextprotocol/express"},"range":">= 2.0.0, < 2.0.2"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-rvq5-wwqv-78pq","source_modified_at":"2026-10-20T19:43:37Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"@modelcontextprotocol/server-legacy"},"range":">= 2.0.0, < 2.3.1"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-rvq5-wwqv-78pq","source_modified_at":"2026-10-20T20:00:04.595309934Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"@modelcontextprotocol/sdk","ecosystem":"npm","purl":"pkg:npm/%40modelcontextprotocol/sdk"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.6.0"},{"fixed":"1.32.0"}]}],"versions":[]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-rvq5-wwqv-78pq","source_modified_at":"2026-10-20T20:00:04.595309934Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"@modelcontextprotocol/server","ecosystem":"npm","purl":"pkg:npm/%40modelcontextprotocol/server"},"ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.3.0"}]}],"versions":[]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-rvq5-wwqv-78pq","source_modified_at":"2026-10-20T20:00:04.595309934Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"@modelcontextprotocol/express","ecosystem":"npm","purl":"pkg:npm/%40modelcontextprotocol/express"},"ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.0.2"}]}],"versions":[]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-rvq5-wwqv-78pq","source_modified_at":"2026-10-20T20:00:04.595309934Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"@modelcontextprotocol/server-legacy","ecosystem":"npm","purl":"pkg:npm/%40modelcontextprotocol/server-legacy"},"ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.3.1"}]}],"versions":[]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-rvq5-wwqv-78pq","source_modified_at":"2026-10-20T19:43:37Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"@modelcontextprotocol/sdk"},"version":"1.32.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-rvq5-wwqv-78pq","source_modified_at":"2026-10-20T19:43:37Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"@modelcontextprotocol/server"},"version":"2.3.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-rvq5-wwqv-78pq","source_modified_at":"2026-10-20T19:43:37Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"@modelcontextprotocol/express"},"version":"2.0.2"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-rvq5-wwqv-78pq","source_modified_at":"2026-10-20T19:43:37Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"@modelcontextprotocol/server-legacy"},"version":"2.3.1"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-rvq5-wwqv-78pq","source_modified_at":"2026-10-20T20:00:04.595309934Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"@modelcontextprotocol/sdk","ecosystem":"npm","purl":"pkg:npm/%40modelcontextprotocol/sdk"},"version":"1.32.0"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-rvq5-wwqv-78pq","source_modified_at":"2026-10-20T20:00:04.595309934Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"@modelcontextprotocol/server","ecosystem":"npm","purl":"pkg:npm/%40modelcontextprotocol/server"},"version":"2.3.0"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-rvq5-wwqv-78pq","source_modified_at":"2026-10-20T20:00:04.595309934Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"@modelcontextprotocol/express","ecosystem":"npm","purl":"pkg:npm/%40modelcontextprotocol/express"},"version":"2.0.2"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-rvq5-wwqv-78pq","source_modified_at":"2026-10-20T20:00:04.595309934Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"@modelcontextprotocol/server-legacy","ecosystem":"npm","purl":"pkg:npm/%40modelcontextprotocol/server-legacy"},"version":"2.3.1"}],"cvss":6.8,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-20T19:43:36Z","modified_at":"2026-10-20T20:00:04.595309934Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-rvq5-wwqv-78pq","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-20T19:43:37Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-rvq5-wwqv-78pq","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-20T20:00:04.595309934Z"}],"sources":["GitHub Advisory Database","OSV"],"references":[{"url":"https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-rvq5-wwqv-78pq","source":"GitHub Advisory Database"},{"url":"https://github.com/modelcontextprotocol/typescript-sdk/commit/40f8f4e229d963cd7fd2890bda2aeebe7005299a","source":"GitHub Advisory Database"},{"url":"https://github.com/modelcontextprotocol/typescript-sdk/commit/5a0724d14cf34a27a3b070224d2996cdd611df9f","source":"GitHub Advisory Database"},{"url":"https://github.com/modelcontextprotocol/typescript-sdk/commit/5a1867390b91b8836f49af76c45427279f513325","source":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-rvq5-wwqv-78pq","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-20T20:00:04.595309934Z","content_hash":"3c6e75bc2e3f4e8de9aca80528ea8ae456ac41df30bfb398513706e6c021df50"}}