Advisoriesby IbisAWSAWS-2026-152
AWS API MCP Server OAuth token audience validation bypass
No fix yet
Read this article
Affected versions
The source does not list versions here. See the source advisory for affected products and fixes.
Changes since it was listed
Severity: Unrated to High
Details and references
- CVSS 3.1
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity from
- NVD
More AWS advisories
All AWS
Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver Connection...CVE-2026-119084no fix yetStored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup renderingCVE-2026-121652no fix yetBabelfish for PostgreSQL Privilege EscalationCVE-2026-119922no fix yetAuthorization bypass through a user-controlled key in the Amazon Q Business Lambda hook...CVE-2026-105811no fix yetImproper limitation of a pathname to a restricted directory in the deployment status...CVE-2026-116635no fix yetStored cross-site scripting in the HTML report generator of aidlc-traceability in AWS...CVE-2026-120497no fix yet