SB20261109231 - Authorization bypass through user-controlled key in typescript-sdk

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261109231

SB20261109231 - Authorization bypass through user-controlled key in typescript-sdk

Published: November 9, 2026

Security Bulletin ID SB20261109231
CSH Severity
High
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-111767)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to access other clients' task information and disrupt their tasks.

The vulnerability exists due to missing session ownership checks in the experimental tasks feature of @modelcontextprotocol/sdk when an HTTP server shares one InMemoryTaskStore across sessions through the taskStore configuration. An unauthenticated remote attacker can list, read, and cancel tasks created by other clients sharing that store.


Remediation

Install update from vendor's website.

References