CVE-2026-115413 in Amazon and Aws Products
Published on October 27, 2026
AWS API MCP Server OAuth Token Audience Validation Bypass
Missing token audience validation in the OAuth authentication mode of AWS API MCP Server before version 1.6.0 might allow local users to run AWS operations with the server's configured AWS credentials via an access token issued to another application by the same identity provider.
To remediate this issue, users should upgrade to version 1.6.0 and configure the expected token audience or client ID for the server.
Vulnerability Analysis
CVE-2026-115413 can be exploited with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Attack Vector:
LOCAL
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH
Weakness Type
Origin Validation Error
The software does not properly verify that the source of data or communication is valid.
Products Associated with CVE-2026-115413
stack.watch emails you whenever new vulnerabilities are published in Amazon Aws or Aws Api Mcp Server. Just hit a watch button to start following.
Affected Versions
aws-api-mcp-server:- Version 1.3.0 and below 1.6.0 is affected.