The Model Context Protocol Python SDK contains a flaw in its server-side bearer authentication routine. The token_verifier accepts a bearer token that was issued for a different resource server because the verifier does not independently validate the token’s audience claim (aud). This flaw allows a token holder to authenticate to an unintended MCP server, thereby gaining the permissions associated with that token on the wrong server. The impact is the unauthorized access, potentially exposing data or operations governed by that resource server. The weakness is identified as a resource level misconfiguration in access control.

The issue affects releases of the SDK from version 1.10.0 up to but not including 1.30.0 and also older 2.x releases prior to 2.2.0. The securityfix was incorporated in the 1.30.0 release and the 2.2.0 release. Any users of the 1.x series before 1.30.0 or the 2.x series before 2.2.0 are exposed.

The CVSS score of 6.8 indicates a serious but not critical severity. Exploit probability information (EPSS) is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is token replay across resource servers. An adversary with a valid token for one resource can simply use that token against a different MCP server without needing additional credentials. If the target server grants broad access or handles sensitive data, the compromise can be severe. The absence of mandatory audience validation is the definitive vulnerability that makes this attack feasible.