CVE-2026-115413 - AWS API MCP Server OAuth token audience validation bypass
// AI summary
AWS API MCP Server has CVE-2026-115413, an OAuth token audience validation bypass flaw affecting the open source Model Context Protocol server used by AI assistants interacting with AWS services.
// from the source
Bulletin ID: 2026-152-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/27/2026 11:00 AM PDT Description: The AWS API MCP Server is an open source Model Context Protocol (MCP) server that enables AI assistants to interact with AWS services and resources through AWS CLI commands. It can be configured to serve the streamable-http transport with OAuth authentication, validating a bearer token against an identity provider nominated by the operator. We identified CVE-20