The report
An access token can be authentic and still be unauthorized for the service receiving it. AWS disclosed CVE-2026-115413 in versions 1.3.0 up to, but not including, 1.6.0 of its API MCP Server with streamable HTTP OAuth. The server validated signature, issuer and expiry but omitted the token audience check. A token legitimately issued to another application by the trusted issuer could then reach MCP tool operations using credentials configured on the server.
The missing check did not mean arbitrary anonymous strings would authenticate. The attacker still needed a relevant token from the same identity provider, and the risk depended on the HTTP OAuth deployment path. AWS released version 1.6.0 and recommends appropriate audience configuration, with a stdio transport workaround where upgrades are not immediate. See the AWS security bulletin for the affected transport and release.
The AWS-specific Case is distinct from other MCP SDK audience advisories despite the shared pattern. The regression test needs two separate registered client audiences at one issuer. Verify that the token for client A is rejected at client B's tool entry point, before any configured AWS credentials can be exercised.