https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-29T10:49:04.579848+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-116684 CVE-2026-116684 — Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource se… 2026-10-29T10:49:04.581439+00:00

Affected: modelcontextprotocol python-sdk

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, server-side bearer authentication configured through AuthSettings with token_verifier accepts a valid token issued for another service when the authorization server serves multiple resources and the TokenVerifier does not independently validate the aud audience. This resource-confusion flaw lets a token holder authenticate to the wrong MCP server and exercise that token's resulting access. This issue is fixed in versions 1.30.0 and 2.2.0.