What happened
Server-side bearer authentication configured through AuthSettings with token_verifier fails to verify that the presented token's audience matches the MCP server resource, so a credential minted for another relying party is accepted. This is a cross-service resource-confusion / authorization-consistency flaw (CWE-863, CVSS 6.8).
Why it matters
MCP is the standard agent-tool transport; a token-confusion flaw lets a holder authenticate to an MCP server they were never authorized for and exercise that session's tool access — a path for prompt-injected or otherwise privileged agents to reach MCP tools beyond their grant.
Attack vector
When an authorization server serves several resources and the TokenVerifier does not independently validate the aud claim, a valid token issued for one service is accepted to authenticate to a different MCP server, letting the token holder exercise that token's access on the wrong server.
Affected systems
MCP Python SDK >= 1.10.0, < 1.30.0 and >= 2.0.0, < 2.2.0
Mitigation
Upgrade to MCP Python SDK 1.30.0 or 2.2.0 (GHSA-w4fh-qvv9-3v23); ensure token_verifier validates the audience/resource against the specific MCP server.