CVE-2026-116684

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, server-side bearer authentication configured through AuthSettings with tokenverifier accepts a valid token issued for another service when the...

CVE-2026-116684

The Model Context Protocol Python SDK versions 1.10.0 through 1.30.0 and 2.2.0 are vulnerable to a resource-confusion flaw in the server-side bearer authentication. When configured via AuthSettings with token_verifier, the TokenVerifier fails to independently validate the aud audience , causing t...

EUVD-2026-111369

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, server-side bearer authentication configured through AuthSettings with tokenverifier accepts a valid token issued for another service when the...

CVE-2026-116684 Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, server-side bearer authentication configured through AuthSettings with tokenverifier accepts a valid token issued for another service when the...