GHSA-w4fh-qvv9-3v23: Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server

Summary

The MCP Python SDK's server-side bearer authentication did not check that a token was issued for the receiving server (its audience). Where one authorization server issues tokens for several services, a valid token for another service was accepted by the MCP server. Affected versions are mcp 1.10.0 through 1.29.1 and 2.0.0 through 2.1.1.

Mitigation

Upgrade to mcp 1.30.0 or later (1.x) or mcp 2.2.0 or later (2.x), then set validate_token_resource=True in AuthSettings with resource_server_url set to the audience the authorization server puts in tokens, and return the token's audience from verify_token() as AccessToken.resource. Upgrading alone changes nothing. If your TokenVerifier already checks the audience, set validate_token_resource=False to silence the deprecation warning. If you cannot upgrade yet, reject any token whose aud does not include your server inside verify_token().

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• mcpPyPILLM dependency since 2024-11-20 · 61 tracked dependents

Topics

• Model Context Protocol

Related items

• MediumGHSA-5h93-6whr-6q8j: Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodiesSame vendor · GitHub Advisory Database
• MediumGHSA-rwrf-2pqf-9j8j: Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemasSame vendor · GitHub Advisory Database
• HighGHSA-f897-62hf-6gxq: MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch lengthSame vendor · GitHub Advisory Database
• HighGHSA-46jr-4wx8-v453: MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validationSame vendor · GitHub Advisory Database
• HighGHSA-22jm-h49p-29qw: MCP TypeScript SDK: Experimental tasks were not tied to the session that created themSame vendor · GitHub Advisory Database