The Model Context Protocol (MCP) Python SDK, known as mcp on PyPI, prior to version 1.27.2, contains an authorization bypass vulnerability (CWE-639). The SSE and stateful Streamable HTTP transports (mcp.server.sse.SseServerTransport and mcp.server.streamable_http_manager.StreamableHTTPSessionManager) route requests to existing sessions using only the session_id query parameter or Mcp-Session-Id header. They do not verify that the authenticated principal making the request is the creator of the session. This flaw allows a different client authenticated with a bearer token, who knows a valid session ID, to inject JSON-RPC messages into that session. The vulnerability has a CVSS 3.1 base score of 7.1 (high severity), reflecting network attack vector, high impact on confidentiality and integrity, and low impact on availability. The issue is resolved in version 1.27.2.

An attacker with a bearer token and knowledge of a valid session ID can inject unauthorized JSON-RPC messages into another client's session. This compromises confidentiality and integrity of the session data, potentially allowing unauthorized actions or data manipulation within the affected session. Availability impact is low. There are no known exploits in the wild as of the published date.

Upgrade to version 1.27.2 or later of the modelcontextprotocol Python SDK, where this authorization bypass vulnerability is fixed. Patch status is confirmed by the version fix noted in the description. No other mitigation steps are indicated by the vendor advisory.