Evidence · DiggingBeagle record
Advisory: Official MCP TypeScript SDK accepts wrong OAuth resource audience unless opt-in validator configured
The official MCP TypeScript SDK accepted OAuth bearer tokens intended for a different resource when an application omitted the optional expected-resource audience validator. GHSA-rvq5-wwqv-78pq documents audience confusion and its validation guidance. Updating a library without configuring the validator does not establish that an application now enforces audience binding. Research/disclosure claims are specific to the documented settings; do not infer unreported victims or additional compromise.
- Source role
- primary disclosure
Evidence record
The official MCP TypeScript SDK accepted OAuth bearer tokens intended for a different resource when an application omitted the optional expected-resource audience validator. GHSA-rvq5-wwqv-78pq documents audience confusion and its validation guidance. Updating a library without configuring the validator does not establish that an application now enforces audience binding. Research/disclosure claims are specific to the documented settings; do not infer unreported victims or additional compromise.
Claim-level citations (3)
- supportsMCP TypeScript SDK accepted OAuth tokens for the wrong resource without opt-in checks: GHSA-rvq5-wwqv-78pq documents audience confusion and its validation guidance. Updating a library without configuring the validator does not establish that an application now enforces audience binding.
GHSA-rvq5-wwqv-78pq; resource validation option and exploit conditions
- supportsMCP TypeScript SDK accepted OAuth tokens for the wrong resource without opt-in checks: The official MCP TypeScript SDK accepted OAuth bearer tokens intended for a different resource when an application omitted the optional expected-resource audience validator.
GHSA-rvq5-wwqv-78pq; resource validation option and exploit conditions
- supportsMCP TypeScript SDK accepted OAuth tokens for the wrong resource without opt-in checks: The MCP SDK advisory identifies patched packages including @modelcontextprotocol/sdk 1.32.0, @modelcontextprotocol/server 2.3.0, @modelcontextprotocol/express 2.0.2, and server-legacy 2.3.1. Resource audience enforcement still requires applications to configure expectedResource and use AuthInfo.resource correctly.
GHSA-rvq5-wwqv-78pq: fixed packages and expectedResource/AuthInfo.resource guidance