A token holder requests a protected MCP tool on a different server. The server validates the issuer and token but does not adequately bind the resource/audience claim to the target MCP service before invoking tools. CVE-2026-116684 records resource-server audience verification omissions in the Python MCP SDK. The advisory lists patched Python SDK versions…
Inspect the ClaimsCase · DiggingBeagle record
MCP Python server accepted tokens minted for a different resource
An OAuth validation gap allowed an otherwise valid bearer token to be replayed across resource servers sharing an identity provider.
Scope
The outcome depends on how multiple services trust the issuer and whether protected resources enforce their own limits. No particular real customer compromise is established by the advisory.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
The Python SDK advisory specifies tokens accepted for the wrong resource server when one issuer serves multiple applications and the verifier lacks its own audience check. Fixed versions expose an audience setting that remains off by default, so upgrading alone is insufficient. Impact is left ungraded because a calibrated 0-to-4 impact basis for actual affected targets is unavailable from these Claims.
Assessed Oct 28, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP22-013-A · CLM-CP22-013-B · CLM-ENRICH-20261028-010 · MCP Python SDK wrong-resource OAuth token acceptance advisory
At a glance
Whether deployments turned on audience checks and separate per-tool scopes is unknown.
Limits and uncertaintyFull account
A token holder requests a protected MCP tool on a different server. The server validates the issuer and token but does not adequately bind the resource/audience claim to the target MCP service before invoking tools.
CVE-2026-116684 records resource-server audience verification omissions in the Python MCP SDK. The advisory lists patched Python SDK versions 1.30.0 and 2.2.0, while warning that deployments may need to enable the resource validation option explicitly. Primary evidence.
The outcome depends on how multiple services trust the issuer and whether protected resources enforce their own limits. No particular real customer compromise is established by the advisory.
Require the intended resource in bearer-token validation and test cross-server reuse with a token valid only for an unrelated MCP endpoint.
Claims & evidence
CLM-CP22-013-ACVE-2026-116684 records resource-server audience verification omissions in the Python MCP SDK.supported
Basis: reported finding
- supportsMCP Python SDK wrong-resource OAuth token acceptance advisoryprimary disclosure
Advisory description; token resource validation
CLM-CP22-013-BThe advisory lists patched Python SDK versions 1.30.0 and 2.2.0, while warning that deployments may need to enable the resource validation option explicitly.supported
Basis: reported finding
- supportsMCP Python SDK wrong-resource OAuth token acceptance advisoryprimary disclosure
Advisory; patched versions and configuration note
CLM-ENRICH-20261028-010The fixed Python SDK versions introduce validate_token_resource, but it remains disabled unless the operator enables it and returns the token audience; merely upgrading does not enforce audience binding.supported
Basis: reported finding
- supportsMCP Python SDK wrong-resource OAuth token acceptance advisoryprimary disclosure
Fix instructions, GHSA-w4fh-qvv9-3v23
Controls and mitigations
- Require the intended resource in bearer-token validation and test cross-server reuse with a token valid only for an unrelated MCP endpoint.
- On SDK 1.30.0 or 2.2.0, set validate_token_resource=True, match resource_server_url to the issuer audience, and return that audience as AccessToken.resource. Test rejection of tokens issued for sibling resource servers.
Unknowns and contradictions
- Whether deployments turned on audience checks and separate per-tool scopes is unknown.
Sources and citation
Material revision history
- Oct 28, 2026 · Canonical change recorded · new in release · revision 199