Package vulnerability, severity high
AWS API MCP Server OAuth token audience validation bypass (CVE-2026-115413)
Published
The AWS API MCP Server, when serving streamable-http with OAuth authentication, validates a token's signature, issuer and expiry but not its audience claim. A token issued by the same identity provider to another application in the same tenant is accepted, which may allow AWS API calls using the credentials configured on the host. Versions >=1.3.0 and <1.6.0 are affected; fixed in 1.6.0.
What's affected
- awslabs.aws-api-mcp-server (pypi)>=1.3.0 <1.6.0
What to do
- Upgrade awslabs.aws-api-mcp-server to version 1.6.0 or later, and patch any forked or derivative code.
- If using AUTH_TYPE=oauth, set AUTH_AUDIENCE, or AUTH_CLIENT_ID for identity providers whose access tokens carry no audience claim, such as Amazon Cognito.
- If you cannot upgrade immediately, use the default stdio transport instead of streamable-http.
Check whether you were affected
Pharon tells teams automatically when this affects something they run. To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it:
/pharon:check-incident aws-api-mcp-server-oauth-audience-bypass-2026-10References
Notice aws-api-mcp-server-oauth-audience-bypass-2026-10, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.