CVE-2025-9611 affects Microsoft Playwright MCP Server versions before 0.0.40. The vulnerability arises because the server fails to validate the Origin header on incoming connections. This flaw allows an attacker to exploit DNS rebinding via a victim's browser to send unauthorized requests to the local MCP server instance. As a result, attackers may trigger MCP tool endpoints unintentionally, potentially leading to unauthorized actions. The CVSS 4.0 base score is 7.2, indicating a high severity vulnerability with network attack vector, low complexity, no privileges required, and user interaction needed.

An attacker can leverage this vulnerability to perform DNS rebinding attacks that cause a victim's browser to send unauthorized requests to a locally running MCP server. This may result in unintended invocation of MCP tool endpoints, potentially leading to unauthorized operations or information disclosure depending on the MCP server's functionality.

No official patch or fix is currently documented for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting access to the MCP server from untrusted networks and monitor for unusual local requests. Avoid exposing the MCP server to untrusted environments or browsers that could be manipulated via DNS rebinding.