AWS discloses OAuth token audience validation bypass in API MCP Server
VULNERABILITYAWSredteam/daily · 1 source
- Severity
- Medium
- Sources
- 1
What happened
AWS has published bulletin CVE-2026-115413 covering an OAuth token audience validation bypass in its API MCP Server. Audience validation checks that an access token was issued for the specific service receiving it, so a bypass could let tokens be accepted outside their intended scope. The source gives no affected versions, CVSS score or fix details, so administrators should consult the full AWS bulletin.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Check whether your environment uses AWS API MCP Server.
- Review the full AWS security bulletin for CVE-2026-115413 for affected versions and the fixed release.
- Apply the vendor update once it is confirmed for your version.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
AWS Security Bulletins
Who and what is in it
Companies