Why forwarding tokens in MCP servers creates a silent privilege-escalation risk

A security vulnerability known as the 'confused deputy' problem arises when MCP servers blindly forward incoming tokens to downstream APIs without verifying whether the caller is actually authorized for that specific action. Because the server holds broad credentials and acts as an intermediary between AI clients and backend systems, it can be manipulated into granting access it should have denied. The MCP specification explicitly requires servers to accept only tokens issued for their own resources and to use separate credentials when making upstream API calls. Common reasons this flaw persists include libraries that make token passthrough the easiest implementation path and test suites that only cover authorized callers. To mitigate the risk, developers should validate token audiences strictly, authorize every request per user and tenant, use dedicated credentials for downstream calls, and maintain detailed audit logs that identify the real actor.