The deepseek-mcp-server component of arikusi exposes a critical function via the POST /mcp HTTP endpoint without authentication in versions >=1.4.2 and <1.8.0. The server's createMcpExpressApp function is called without an authProvider, leaving the route unguarded. This allows any network-reachable client to send unauthenticated initialize requests, obtain valid MCP session identifiers, enumerate available tools, and invoke local tools such as deepseek_sessions and deepseek_chat. The deepseek_chat handler uses the server-side DEEPSEEK_API_KEY if configured, potentially exposing sensitive functionality. This vulnerability applies only to self-hosted HTTP mode, not the hosted BYOK endpoint which requires authorization. The issue is fixed in version 1.8.0.

An unauthenticated attacker on the network can initialize MCP sessions and invoke local tools without credentials, potentially leading to unauthorized access to server functionality. The vulnerability does not impact confidentiality or integrity directly but results in availability impact due to unauthorized session initialization and tool invocation. The CVSS score is 5.3 (medium severity) reflecting network attack vector, no privileges required, no user interaction, and limited impact on availability only.

Upgrade to version 1.8.0 or later, where this authentication bypass vulnerability is patched. Until then, restrict network access to the self-hosted HTTP transport on port 3000 to trusted clients only. Note that the hosted BYOK endpoint is not affected and requires authorization. Patch status is not explicitly stated but version 1.8.0 contains the fix; therefore, upgrading is the recommended remediation.