Skip to content
Fencer Intel
medium 6.8

CVE-2026-111771 json

Model Context Protocol TypeScript SDK: Server bearer authentication accepted tokens issued for another service

published 20d ago modified 4d ago also GHSA-rvq5-wwqv-78pq , EUVD-2026-117801

cvss
6.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 45%
public exploits
0
none known

Summary

The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 1.6.0 until 1.32.0 in @modelcontextprotocol/sdk, from 2.0.0 until 2.3.0 in @modelcontextprotocol/server, from 2.0.0 until 2.0.2 in @modelcontextprotocol/express, and from 2.0.0 until 2.3.1 in @modelcontextprotocol/server-legacy, server-side bearer authentication could accept a valid access token issued for a different service because the SDK did not enforce the token audience. The affected surface is server-side HTTP bearer authentication. The trigger is a valid token whose audience names another service. The authorization server must issue tokens for multiple services, and the application's verifyAccessToken() must not independently validate aud. Applications already validating aud inside verifyAccessToken() are not affected. An attacker with a token for another service could authenticate to the MCP server and obtain the confidentiality and integrity capabilities granted to an authenticated caller. Upgrading alone leaves the new audience validation disabled. Operators must enable audience validation and provide the token audience together. Enabling only the expected audience check causes every request to receive HTTP 401. This issue is fixed in @modelcontextprotocol/sdk 1.32.0, @modelcontextprotocol/server 2.3.0, @modelcontextprotocol/express 2.0.2, and @modelcontextprotocol/server-legacy 2.3.1.

Patch / fix

  • npm @modelcontextprotocol/sdk 1.32.0
  • npm @modelcontextprotocol/server 2.3.0
  • npm @modelcontextprotocol/express 2.0.2
  • npm @modelcontextprotocol/server-legacy 2.3.1

Is CVE-2026-111771 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-111771 updated cvss 6.8

@modelcontextprotocol/sdk: @modelcontextprotocol/server: @modelcontextprotocol/express: @modelcontextprotocol/server-legacy: Model Context Protocol TypeScript SDK: Authentication bypass via missing to

  • Red Hat Hardened Images grafana13.1 13.1.8-0.6.hum1, grafana13.2 13.2.4-0.6.hum1, grafana12.4 12.4.13-0.6.hum1
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.54% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
GitHub 3.1 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
npm @modelcontextprotocol/sdk
>=1.6.0, <1.32.0
1.32.0
npm @modelcontextprotocol/server
>=2.0.0, <2.3.0
2.3.0
npm @modelcontextprotocol/express
>=2.0.0, <2.0.2
2.0.2
npm @modelcontextprotocol/server-legacy
>=2.0.0, <2.3.1
2.3.1

Affected products

  • modelcontextprotocol typescript-sdk
  • @modelcontextprotocol sdk
  • @modelcontextprotocol server
  • @modelcontextprotocol express
  • @modelcontextprotocol server-legacy

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.