MCP TypeScript SDK: Server Bearer Authentication Accepts Tokens Issued for Other Services
Summary
In affected versions of the MCP TypeScript SDK, server-side bearer authentication did not verify that an incoming token was issued specifically for your server (audience validation). In environments where one authorization server issues tokens for multiple services, an MCP server would accept a valid token intended for an entirely different service.
Am I affected?
You are affected if:
- Your HTTP server uses
requireBearerAuth()orverifyBearerToken(), - Its authorization server also issues tokens for other services, and
- Your
verifyAccessToken()does not verify the token audience (aud) independently.
Affected versions:
@modelcontextprotocol/sdk1.6.0 through 1.31.0@modelcontextprotocol/server2.0.0 through 2.2.0@modelcontextprotocol/express2.0.0 through 2.0.1@modelcontextprotocol/server-legacy2.0.0 through 2.3.0
What to do
Upgrade to:
- 1.x:
@modelcontextprotocol/sdk1.32.0 or later - 2.x:
@modelcontextprotocol/server2.3.0 or later, together with@modelcontextprotocol/express2.0.2 or later if you use it @modelcontextprotocol/server-legacy2.3.1 or later
Upgrading alone does not resolve the issue. The patched versions introduce an expectedResource setting that is disabled by default. To enable audience verification, complete both of these changes together:
- Pass the audience your authorization server includes in tokens for your server:
requireBearerAuth({ verifier, expectedResource: new URL('https://mcp.example.com/mcp') }). - Return the token's audience from
verifyAccessToken()asAuthInfo.resource, also aURL.
A token issued for another service will then receive 401. With only the first change applied, every request receives 401.
Workaround:
If upgrading immediately is not possible, reject any token whose aud does not include your server inside verifyAccessToken(). This mitigates the vulnerability on all versions.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | @modelcontextprotocol/express | >= 2.0.0, < 2.0.2 | 2.0.2 |
| npm package | @modelcontextprotocol/sdk | >= 1.6.0, < 1.32.0 | 1.32.0 |
| npm package | @modelcontextprotocol/server | >= 2.0.0, < 2.3.0 | 2.3.0 |
| npm package | @modelcontextprotocol/server-legacy | >= 2.0.0, < 2.3.1 | 2.3.1 |
References
- https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-rvq5-wwqv-78pq
- https://github.com/modelcontextprotocol/typescript-sdk/commit/40f8f4e229d963cd7fd2890bda2aeebe7005299a
- https://github.com/modelcontextprotocol/typescript-sdk/commit/5a0724d14cf34a27a3b070224d2996cdd611df9f
- https://github.com/modelcontextprotocol/typescript-sdk/commit/5a1867390b91b8836f49af76c45427279f513325
- https://github.com/modelcontextprotocol/typescript-sdk
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N- Weakness (CWE)
CWE-863- Platform
- npm
- Package
@modelcontextprotocol/express, @modelcontextprotocol/sdk, @modelcontextprotocol/server- Disclosed
- 20.10.2026
- Updated
- 20.10.2026 23:18
Sources and licenses · Edited or translated by DockRay; source rights and applicable licenses are retained.
OSV / GitHub Advisory Database - GHSA-rvq5-wwqv-78pq - CC BY 4.0
Vulnerability history: @modelcontextprotocol/server
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 3
- First → latest
- 10.2026 10.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 2
- Medium 1
Disclosures per year
- 2026: 3
-
MCP TypeScript SDK: Server Bearer Authentication Accepts Tokens Issued for Other Services this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.