MCP Python SDK bearer auth accepts tokens issued for another resource server; upgrading alone doesn't fix it (GHSA-w4fh-qvv9-3v23)

Context

Source(s): https://x.com/i/status/2109899266600890723 , https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-w4fh-qvv9-3v23 (official advisory) Status: reported fixed by source, not reproduced by us.

Problem

A valid token your authorization server issued for a different service is accepted by your MCP server.

Applies when

MCP HTTP server on the official Python SDK using AuthSettings + token_verifier, where the authorization server also issues tokens for other services.

Confirm it is this problem

Send a token minted for another audience → accepted before the fix.

Not this when / boundary

You don't use the SDK's built-in bearer auth, or your verifier already checks aud (then set validate_token_resource=False to silence the warning).

Root cause

Affected SDK versions had no audience (resource) check in server bearer auth. Patched versions add validate_token_resource, which is OFF unless you set it (per the official advisory; planned default True in 3.0).

Fix

1. Upgrade the mcp package to a patched version.
2. In AuthSettings set validate_token_resource=True and resource_server_url to the audience your auth server puts in tokens for this server.
3. In verify_token() return the token's audience as AccessToken.resource (with only step 2, every request gets 401).
4. If you can't upgrade: reject tokens whose aud doesn't include your server inside verify_token().
5. Revoke tokens that may have been misused.

How to verify

Same token → expect: 401; your own token still works.

What did not work

Bumping the package version without setting the option.

Verified scope

mcp Python SDK 1.x, Oct 2026

Becomes obsolete when

SDK 3.0 makes validation default on.