AWS discloses OAuth token audience validation bypass in API MCP Server
VULNERABILITYAWSredteam/daily · 1 source
- Severity
- Medium
- Sources
- 1
What happened
AWS Security Bulletins has published CVE-2026-115413, an OAuth token audience validation bypass affecting AWS API MCP Server. The flaw suggests access tokens may not be checked for their intended audience, which could allow tokens issued for other resources to be accepted. The article does not list affected versions, a CVSS score, or a patched release. Defenders using AWS API MCP Server should review the official bulletin for affected builds and remediation, and check OAuth token validation settings in the meantime.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Check whether your environment uses AWS API MCP Server.
- Review the full AWS security bulletin for CVE-2026-115413 for affected versions and the fixed release.
- Apply the vendor update once it is confirmed for your version.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
AWS Security Bulletins
Who and what is in it
Companies