جزئیات آسیب‌پذیری

خلاصه‌ی فارسی برای این آسیب‌پذیری هنوز تهیه نشده است.

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, server-side bearer authentication configured through AuthSettings with token_verifier accepts a valid token issued for another service when the authorization server serves multiple resources and the TokenVerifier does not independently validate the aud audience. This resource-confusion flaw lets a token holder authenticate to the wrong MCP server and exercise that token's resulting access. This issue is fixed in versions 1.30.0 and 2.2.0.

• https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-w4fh-qvv9-3v23 x_refsource_CONFIRM
• https://github.com/modelcontextprotocol/python-sdk/pull/3447 x_refsource_MISC
• https://github.com/modelcontextprotocol/python-sdk/pull/3451 x_refsource_MISC
• https://github.com/modelcontextprotocol/python-sdk/commit/0c9136841ff092987a20700ff9c2c9789bda2f40 x_refsource_MISC
• https://github.com/modelcontextprotocol/python-sdk/commit/8c2fa6eabacde869d75568e33b9d466b58c2f512 x_refsource_MISC
• https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.30.0 x_refsource_MISC
• https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.2.0 x_refsource_MISC