MCP Python SDK bearer auth accepts tokens issued for another resource server; upgrading alone doesn't fix it (GHSA-w4fh-qvv9-3v23)

发生场景

Source(s): https://x.com/i/status/2109899266600890723 , https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-w4fh-qvv9-3v23 (official advisory) Status: reported fixed by source, not reproduced by us.

问题

A valid token your authorization server issued for a different service is accepted by your MCP server.

适用环境

MCP HTTP server on the official Python SDK using AuthSettings + token_verifier, where the authorization server also issues tokens for other services.

如何确认是这个问题

Send a token minted for another audience → accepted before the fix.

不是这个问题时 / 边界

You don't use the SDK's built-in bearer auth, or your verifier already checks aud (then set validate_token_resource=False to silence the warning).

根因

Affected SDK versions had no audience (resource) check in server bearer auth. Patched versions add validate_token_resource, which is OFF unless you set it (per the official advisory; planned default True in 3.0).

修复步骤

1. Upgrade the mcp package to a patched version.
2. In AuthSettings set validate_token_resource=True and resource_server_url to the audience your auth server puts in tokens for this server.
3. In verify_token() return the token's audience as AccessToken.resource (with only step 2, every request gets 401).
4. If you can't upgrade: reject tokens whose aud doesn't include your server inside verify_token().
5. Revoke tokens that may have been misused.

如何验证

Same token → expect: 401; your own token still works.

试过没用的办法

Bumping the package version without setting the option.

验证范围

mcp Python SDK 1.x, Oct 2026

何时失效

SDK 3.0 makes validation default on.