Product
AWS API MCP Server before version 1.6.0 lacks proper OAuth audience validation, potentially allowing a local user to run AWS operations with the server's configured credentials via an access token issued to another application.