The DeepSeek MCP Server (arikusi deepseek-mcp-server) has an authorization bypass vulnerability (CWE-639) in versions starting at 1.4.2 and prior to 1.7.0. The process-global SessionStore accepts caller-supplied session_id values without binding them to authenticated principals or transport sessions. This flaw enables attackers to enumerate active session IDs via the deepseek_sessions interface and reuse victim session IDs in deepseek_chat to retrieve and continue the victim's conversation context. The vulnerability is fixed in version 1.7.0.

An attacker without privileges can enumerate active session IDs and hijack victim sessions by reusing session IDs, leading to unauthorized access to sensitive conversation data (confidentiality impact is high). Integrity impact is low since the attacker can only continue conversations but not necessarily alter other data. Availability impact is low as the vulnerability does not directly affect service availability.

A fix is available in DeepSeek MCP Server version 1.7.0. Users should upgrade to version 1.7.0 or later to remediate this vulnerability. Patch status is confirmed by the vendor's versioning information. Until upgraded, users should restrict access to the deepseek_sessions interface to trusted parties to reduce risk.