Model Context Protocol Python SDK: server Bearer token authentication accepts tokens issued for other resource servers

The Model Context Protocol (MCP) Python SDK has published a security advisory (GHSA-w4fh-qvv9-3v23, CVE-2026-116684): in affected versions, its server Bearer token authentication cannot validate the token's audience, so when the same authorization server issues tokens for multiple services, a valid token issued for another service is also accepted by the MCP server. Affected versions are mcp 1.10.0 and above and before 1.30.0, and 2.0.0 and above and before 2.2.0; fixed in 1.30.0 and 2.2.0. The advisory emphasizes that upgrading alone does not enable validation: the new validate_token_resource setting is off by default and must be enabled in AuthSettings with resource_server_url configured, and the token audience must also be returned in verify_token(); doing only the first step causes all requests to return 401.