CVE-2026-111771 | Model Context Protocol sdk/server/express/server-legacy aud improper authorization

October 20, 2026 Yanac

A vulnerability was found in Model Context Protocol. It has been rated as critical. This issue affects the function requireBearerAuth/verifyBearerToken/verifyAccessToken of the component sdk/server/express/server-legacy. This manipulation of the argument aud causes improper authorization.

This vulnerability is handled as CVE-2026-111771. The attack can be initiated remotely. There is not any exploit available.VulDB Recent EntriesRead More