The vulnerability arises because the Model Context Protocol SDK allows server‑side bearer authentication to accept a JSON Web Token that was issued for a different service; the SDK does not enforce the token audience claim. An attacker who possesses a valid token for one service can present it to another service and gain both confidentiality and integrity privileges normally reserved for an authenticated caller. This flaw results in an authentication bypass that permits unauthorized access to the MCP server.

Affected products include the @modelcontextprotocol/sdk from versions 1.6.0 to 1.32.0, @modelcontextprotocol/server from 2.0.0 to 2.3.0, @modelcontextprotocol/express from 2.0.0 to 2.0.2, and @modelcontextprotocol/server‑legacy from 2.0.0 to 2.3.1. The issue exists in all server‑side HTTP bearer authentication implementations of these packages.

The CVSS score of 6.8 indicates a moderate to high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the attack vector is likely remote via any exposed API that accepts bearer tokens. Exploitation requires an attacker to obtain a legitimate token issued for another service and to have the target service use an unmodified verifyAccessToken() that does not independently validate the aud claim. Because upgrading alone does not enable the audience check, operators must explicitly enable and configure audience validation to mitigate this risk.