CVE-2026-111771
Description
A flaw was found in the Model Context Protocol (MCP) TypeScript SDK. The server-side authentication mechanism fails to verify that incoming access tokens were specifically issued for the target server. A remote attacker with a valid token issued for another service within the same authorization environment can exploit this issue to bypass authentication and gain unauthorized access to server resources.
Statement
This vulnerability is rated as having a Moderate impact because exploitation requires specific architectural preconditions, namely an authorization server that issues tokens for multiple disparate services and an attacker who already holds a valid access token for another service. Deployments are unaffected if the application independently verifies the intended recipient of incoming tokens. Furthermore, the issue only affects server-side HTTP bearer authentication implementations where audience validation has not been explicitly configured.
Mitigation
Validate the token audience within the application's token verification callback:
Configure the application's `verifyAccessToken()` handler to inspect the `aud` (audience) claim of incoming bearer tokens and reject any token that does not explicitly match the expected identifier or URL of the target service.
Implementing this manual check prevents tokens issued for other services from granting access. The affected application service must be restarted for configuration and code changes to take effect.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.8 | N/A | 6.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
An incorrect implementation may allow authentication to be bypassed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
