Evidence · DiggingBeagle record
AWS API MCP Server: OAuth audience not checked
Official AWS bulletin for CVE-2026-115413/GHSA-4prq-p2x5-w9fh, an OAuth audience validation gap in streamable HTTP MCP.
- Published
- Oct 28, 2026
- Source role
- vendor statement
Evidence record
Official AWS bulletin for CVE-2026-115413/GHSA-4prq-p2x5-w9fh, an OAuth audience validation gap in streamable HTTP MCP.
Claim-level citations (1)
- supportsAWS API MCP Server accepted valid tokens minted for the wrong application: AWS states that the affected API MCP Server streamable HTTP integration omitted OAuth audience verification and that version 1.6.0 corrects this boundary.
AWS security bulletin 2026-152, affected versions, OAuth audience verification and mitigations