AWS discloses OAuth token audience validation bypass in API MCP Server
VULNERABILITYAWSredteam/daily · 1 source
- Severity
- Medium
- Sources
- 1
What happened
Amazon Web Services has published a security bulletin about a flaw in its API MCP Server, a tool that lets AI assistants interact with AWS. The flaw could let a login token meant for one service be accepted by another, which could allow unauthorised access. The bulletin's title is the only detail available in the source, so the full impact is not yet clear.
Like I’m new · Written by AI from 1 source · Wrong?
What to do
- Check whether your environment uses AWS API MCP Server.
- Review the full AWS security bulletin for CVE-2026-115413 for affected versions and the fixed release.
- Apply the vendor update once it is confirmed for your version.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
AWS Security Bulletins
Who and what is in it
Companies