Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-115413

Missing token audience validation in the OAuth authentication mode of AWS API MCP Server before…

Risk score
47/100
CVSS
7.8 v3.1
Published
27 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Missing token audience validation in the OAuth authentication mode of AWS API MCP Server before version 1.6.0 might allow local users to run AWS operations with the server's configured AWS credentials via an access token issued to another application by the same identity provider. To remediate this issue, users should…
Affected
See advisory
Fix
Upgrade the product to 1.6.0 or later.
Exploitation
No known exploitation

Why it is Yellow

  • CVSS 7.8 high

References

Original description

Missing token audience validation in the OAuth authentication mode of AWS API MCP Server before version 1.6.0 might allow local users to run AWS operations with the server's configured AWS credentials via an access token issued to another application by the same identity provider. To remediate this issue, users should upgrade to version 1.6.0 and configure the expected token audience or client ID for the server.

Last activity 27 Oct 2026. Patch Forecast updates every hour.