AWS API MCP Server EUVD-2026-111349

Exploitable ONLY when the server is deployed with the non-default streamable-http transport AND OAuth authentication enabled against an operator-nominated identity provider; the default stdio transport is not affected. The attacker must be a local caller (AV:L) who already possesses a valid, unexpired, correctly-signed bearer token issued by that same identity provider to a different application/client in the same tenant (for example a second app client in the same Amazon Cognito user pool) - the server fails to validate the token's audience/client-id claim. Resulting access is bounded by the permissions of the AWS credentials configured on the host. Limiting factors: non-default configuration required, local access required (PR:L / authenticated), and the attacker must obtain a same-tenant sibling-app token (AT:P). Fixed in 1.6.0, which additionally requires operators to set an expected token audience or client ID; the documented workaround is to use the default stdio transport instead of streamable-http.

This is a genuine but conditional, non-default-exposure issue rather than a drop-everything emergency. The AWS CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:L/UI:N) scores it 7.3 High, and the impact triple is severe (VC:H/VI:H/VA:H) because a successful attacker executes arbitrary AWS operations under the host's configured credentials. However, several signals temper real-world risk: the vector is LOCAL (AV:L), it requires a present attack condition (AT:P) - the attacker must already hold a valid bearer token the operator's own identity provider issued to a different application in the same tenant - and it requires some privilege (PR:L), so it is an authenticated weakness, not anonymous remote code access. No EPSS score and no SSVC exploitation/automatable values were supplied, so probabilistic exploitation likelihood cannot be quantified from this data. The vulnerability is NOT on CISA KEV and no working exploit code is reported; only a vendor/GHSA advisory exists. The vuln.today decision label is 'this_week', consistent with a serious issue that is bounded by non-default configuration (only streamable-http + OAuth deployments are affected) rather than ubiquitous unauthenticated exposure. Net: prioritize patching for the specific affected deployment mode, but this is not a wormable internet-facing critical.

An operator runs the AWS API MCP Server with the streamable-http transport and OAuth authentication backed by, for example, an Amazon Cognito user pool. A local caller who holds a bearer token that the same Cognito pool issued to a second, unrelated app client in the same tenant presents that token; because the server validates signature, issuer and expiry but not the token's audience/client-id claim, the token is accepted and the caller issues AWS CLI operations using the host's configured AWS credentials. No public working exploit code is reported, though the issue is documented in the awslabs GHSA advisory.