What happened
AWS disclosed (security bulletin 2026-152-AWS, published 2026-10-27, CVSS 7.8) that the AWS API MCP Server's OAuth authentication mode fails to validate the token audience. Before v1.6.0, a token issued to another application by the same identity provider can be used to exercise AWS operations with the server's configured AWS credentials.
Why it matters
This is an agent-privilege confusion flaw: the MCP server holds a privileged AWS credential, and a missing audience check lets an adjacent application/user borrow that privilege. For agents that manage cloud infra, this can turn a token issued for one app into unauthorized AWS console/CLI access as the agent.
Attack vector
The OAuth mode does not validate the token's audience. A local user could run AWS operations with the server's configured AWS credentials using an access token that was issued to a different application by the same identity provider, effectively impersonating the server agent's privilege across applications.
Affected systems
aws-api-mcp-server < 1.6.0 (OAuth authentication mode)
Mitigation
Upgrade to aws-api-mcp-server 1.6.0+; ensure the OAuth server enforces audience/scope and that only intended client application IDs receive tokens usable by the MCP server.