Meta Ads MCP, a Model Context Protocol server for running Meta Ads, had an authentication bypass vulnerability in the AuthInjectionMiddleware.dispatch() function before version 1.0.109. Unauthenticated Streamable HTTP requests were forwarded to MCP tool handlers without a 401 challenge, allowing any network-reachable caller to invoke tools without authentication. When no per-request credential was present, handlers used the META_ACCESS_TOKEN environment variable. If the downstream Meta Graph API call failed, the raw httpx request URL containing the operator's access_token was serialized into the JSON-RPC response, exposing the credential to unauthenticated callers. Version 1.0.109 addresses this issue.

An attacker can invoke MCP tools without authentication and potentially obtain sensitive access tokens leaked in error responses. This leads to a complete compromise of confidentiality and integrity of the affected system's Meta Ads operations. The CVSS v3.1 score is 9.1 (critical), reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality and integrity.

Upgrade to meta-ads-mcp version 1.0.109 or later, where this authentication bypass and credential leakage vulnerability is fixed. Patch status is not explicitly confirmed in the vendor advisory, but the description states version 1.0.109 fixes the issue. Until upgraded, restrict network access to the MCP server to trusted parties only.