Threats tagged 'brew-mistral-vibe-cve-2026-52869'

A vulnerability in the MCP Python SDK HTTP transports (SSE and Streamable HTTP in stateful mode) allows session hijacking by bypassing authentication checks. Incoming requests are routed to existing sessions based solely on session IDs without verifying the authenticated principal. This enables an attacker who obtains a session ID to send JSON-RPC messages on that session regardless of the bearer token used. The issue affects versions from 1.1.1 up to but not including 2.17.0. A fix is available in version 2.17.0.