An AWS API MCP Server on streamable HTTP checked token signatures and basic issuer and expiry properties but failed to bind the audience to the intended resource. A caller could therefore present a real token that had been issued for another application at the same issuer. The server would evaluate the request using its configured AWS credentials, making…
Inspect the ClaimsCase · DiggingBeagle record
AWS API MCP Server accepted valid tokens minted for the wrong application
An OAuth validation gap allowed a token from a shared issuer and different audience to access server tools under configured AWS credentials.
Scope
Streamable HTTP OAuth path in affected AWS API MCP Server versions, with a valid token issued to another resource by the configured issuer; no verified production exploitation.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- fixed reported
- AI role
- AGAINST AI
Basis and provenance
AWS documents an authorization flaw and a versioned repair. A random unauthenticated token and actual credential disclosure are not established. Impact remains unrated because the scoped record does not establish a calibrated severity-to-impact-band mapping.
Assessed Oct 31, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-C26-AWS-API-MCP-AUDIENCE-1 · AWS API MCP Server: OAuth audience not checked
At a glance
Signature, issuer and expiry validation do not authorize the token for every service behind the issuer.
Read the implicationsAffected deployment prevalence and actual unauthorized billed inference are not known.
Limits and uncertaintyFull account
An AWS API MCP Server on streamable HTTP checked token signatures and basic issuer and expiry properties but failed to bind the audience to the intended resource. A caller could therefore present a real token that had been issued for another application at the same issuer. The server would evaluate the request using its configured AWS credentials, making the absence of an audience check an authorization error rather than an ordinary token-forgery vulnerability.
AWS identifies versions 1.3 through those before 1.6.0 as affected and 1.6.0 as corrected. The condition requires a suitable issuer and valid token; anonymous access with a random string is not demonstrated. This case is distinct from an older MCP Python SDK audience problem even though the trust-boundary pattern is similar. A regression test should use two independently registered clients at one issuer and check resource binding at the actual tool entry point.
Mechanism and trust boundary
- 01
Step
- 02
Step
- 03
Step
Timeline
- Oct 29, 2026disclosure
Public disclosure
Claims & evidence
CLM-C26-AWS-API-MCP-AUDIENCE-1AWS states that the affected API MCP Server streamable HTTP integration omitted OAuth audience verification and that version 1.6.0 corrects this boundary.supported
Basis: reported finding
- supportsAWS API MCP Server: OAuth audience not checkedvendor statement
AWS security bulletin 2026-152, affected versions, OAuth audience verification and mitigations
Implications
Signature, issuer and expiry validation do not authorize the token for every service behind the issuer.
Controls and mitigations
- Verify audience binding on every tool endpoint and reject an authenticated wrong-audience token; update affected aws-api-mcp-server to 1.6.0 or later.
Unknowns and contradictions
- Affected deployment prevalence and actual unauthorized billed inference are not known.
Sources and citation
Material revision history
- Oct 31, 2026 · Canonical change recorded · new in release · revision 208