Authorization Bypass in @arikusi/deepseek-mcp-server via User-Controlled session_id (CWE-639)

Vulnerability Overview Vulnerability Name: Authorization Bypass Through User-Controlled Key in @arikusi/deepseek-mcp-server Vulnerability Description: This vulnerability allows an attacker to bypass authorization through a user-controlled , resulting in cross-session data exposure. Specifically, the accepts a value provided by the caller without binding it to any authenticated principal or transport session. An attacker can enumerate active session IDs and then use a victim-controlled to retrieve and continue the victim's conversation context within . Impact Scope Affected Versions: >= 1.4.2, < 1.7.0 Fixed Version: 1.7.0 CVSS Score: 8.6 (High) Vulnerability Type: Authorization Bypass / Cross-Session Data Exposure (CWE-639) Authentication Required: None Remediation 1. Bind Sessions: Bind stored sessions to the authenticated transport session or other server-generated opaque identifiers. 2. Restrict Session IDs: Do not allow arbitrary user-provided values to select existing server-side state. 3. Remove or Restrict Enumeration: Remove or restrict the list so that it does not disclose unrelated session IDs. 4. Verify Session Ownership: Reject session reuse unless the caller can prove ownership of that session. POC Code Additional Evidence File: Patch (Maintainer) Fixed Version: 1.7.0 Fix Details: The for the HTTP transport is no longer a process-level singleton; each MCP HTTP session has its own instance, injected into the and tool handlers. Therefore, one HTTP session cannot read, enumerate, or clear another session's state. The STDIO transport is unaffected (one client per process). Integration tests in verify isolation. Workarounds If an immediate upgrade is not possible, run using the STDIO transport (set ) or disable the HTTP transport. Credits Reporter: @232-323 and @2REBCat (tested on 1.6.0) Fixer: Maintainer Release Date: 1.7.0 Severity Details CVSS Score: 8.6 (High) CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N Impact: A connected client can read other clients' conversation history (C:H), inject messages into their sessions (I:L), and clear or delete other clients' sessions (A:L). The scope remains unchanged; the impact stays within the application's authorization boundaries. This is a cross-tenant authorization bypass (CWE-639), making "S:U" (Scoped) correct.

Goal Reached Thanks to every supporter — we hit 100%!

Authorization Bypass in @arikusi/deepseek-mcp-server via User-Controlled session_id (CWE-639)

More from this source