What happened
The MCP TypeScript SDK's server-side bearer authentication did not enforce the OAuth token audience, so a valid token minted for another service is accepted. In multi-service deployments an attacker holding a token for one service can authenticate to an MCP server as an authorized caller.
Why it matters
MCP servers are frequently deployed in shared OAuth ecosystems where one authorization server issues tokens across several services; a missing audience check lets a token intended for another service unlock MCP tools, an authentication-bypass path into agent tool surfaces.
Attack vector
Server-side HTTP bearer authentication accepts a valid access token issued for a different service because the SDK does not enforce the token audience. A caller holding a token for another service can authenticate to the MCP server and obtain the confidentiality and integrity capabilities granted to an authenticated caller.
Affected systems
@modelcontextprotocol/sdk >= 1.6.0, < 1.32.0; @modelcontextprotocol/server >= 2.0.0, < 2.3.0; @modelcontextprotocol/express >= 2.0.0, < 2.0.2; @modelcontextprotocol/server-legacy >= 2.0.0, < 2.3.1
Mitigation
Upgrade to @modelcontextprotocol/sdk 1.32.0 / server 2.3.0 / express 2.0.2 / server-legacy 2.3.1, then enable audience validation and provide the expected token audience (upgrading alone leaves the new validation disabled). Advisory: https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-rvq5-wwqv-78pq