AWS API MCP Server OAuth Token Validation Bypass – Update Required
AWS API MCP Server versions 1.3.0 through 1.5.x have a critical OAuth validation flaw (CVE-2026-115413). The server skips checking the token's audience claim, letting attackers bypass authentication. If you're running the affected versions with OAuth enabled, upgrade to 1.6.0+ immediately—this one needs your attention.
source: [aws/security-bulletin]