AWS API MCP Server: Missing OAuth token audience validation
Summary
AWS API MCP Server versions 1.3.0 up to, but not including, 1.6.0 do not verify that an OAuth access token was issued for the server's own application. A local user who holds a valid token issued by the same identity provider to another application in the same tenant can make AWS API calls using the credentials configured on the host. The issue only affects deployments that use the streamable-http transport with OAuth authentication; the default stdio transport is not affected. The impact is limited by the permissions of the configured AWS credentials.
Affected
- awslabs.aws-api-mcp-server (PyPI) from 1.3.0 up to, but not including, 1.6.0
- Only deployments with the streamable-http transport and OAuth authentication (AUTH_TYPE=oauth)
- Default configuration (stdio transport) is not affected
Fixed in
- Upgrade to awslabs.aws-api-mcp-server 1.6.0 or later
- Configure the expected token audience (AUTH_AUDIENCE) or client ID (AUTH_CLIENT_ID for identity providers such as Amazon Cognito that issue tokens without an audience claim)
Workaround
- Use the default stdio transport instead of the streamable-http transport until the upgrade is done
- Restrict local access to the host running the server
- Limit the IAM permissions of the server's AWS credentials to the minimum required
Exploitation
- No known exploitation in the wild
- Not listed in the CISA KEV catalogue according to the sources reviewed
- No public exploit code known
Our recommendation
- Upgrade to version 1.6.0 or later; prioritise this if OAuth mode is enabled
- Set AUTH_AUDIENCE or AUTH_CLIENT_ID as described in the vendor bulletin
- Check whether the server runs with AUTH_TYPE=oauth and streamable-http
- Review the IAM permissions of the credentials configured on the host and reduce them to the minimum
- Monitor AWS CloudTrail for unexpected API calls made by the server's role
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- AWS Security Bulletin 2026-152-AWS aws.amazon.com
- GitHub Security Advisory GHSA-4prq-p2x5-w9fh github.com
- PyPI awslabs.aws-api-mcp-server 1.6.0 pypi.org
- AWS API MCP Server documentation awslabs.github.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 3 Nov 2026, 01:42.
Original description (NVD)
Missing token audience validation in the OAuth authentication mode of AWS API MCP Server before version 1.6.0 might allow local users to run AWS operations with the server's configured AWS credentials via an access token issued to another application by the same identity provider. To remediate this issue, users should upgrade to version 1.6.0 and configure the expected token audience or client ID for the server.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.