AWS API MCP Server: a token for another app runs AWS commands
A missing audience check let the AWS API MCP Server accept OAuth tokens minted for a different application.
· AWS · Research by Yuval Elbar
AWS API MCP Server before 1.6.0 accepted OAuth bearer tokens issued to any other application in the same identity provider tenant, letting a local caller run AWS CLI commands with the credentials the server host configured.
01What happened
AWS published advisory GHSA-4prq-p2x5-w9fh on 27 October 2026 for the AWS API MCP Server, the package that exposes AWS CLI commands to AI assistants. Yuval Elbar reported the flaw through coordinated disclosure, and AWS shipped the fix in version 1.6.0.
02How it works
Bearer token validation in affected versions covered the signature, the issuer and the expiry, but not the claim recording which application a token was issued to. When one identity provider serves several applications from a single tenant, for example a second app client in the same Amazon Cognito user pool, that provider mints tokens the MCP server also accepts. A local caller holding such a token reaches the server's tool surface and runs AWS API calls under the host's configured credentials, bounded only by what those credentials permit.
03Who is affected
Versions 1.3.0 up to 1.6.0 are exposed only where the server runs the streamable-http transport together with OAuth authentication. Deployments left on the default stdio transport are not affected. The server's README states that this package is superseded by the official AWS MCP server and links a migration guide.
04What to do
Upgrade to 1.6.0, which also requires OAuth users to configure an expected token audience or client ID. Where an upgrade has to wait, switch the server back to the default stdio transport.
Sources 2 links, all fetched
- 1github.comAWS Advisory
- 2github.comServer Readme