David Carliez

**Name of the Vulnerable Software and Affected Versions** Google mcp-toolbox versions 1.3.0 through 1.4.0 **Description** Incorrect authorization in the direct HTTP API tool invocation endpoint allows an unauthenticated attacker to invoke tools protected by the scopeRequired feature. This occurs when tool invocation requests are sent through legacy HTTP endpoints while the `--enable-api` flag is active. **Recommendations** For versions 1.3.0 through 1.4.0, disable the `--enable-api` flag to prevent unauthorized tool invocation via legacy HTTP endpoints.

**Name of the Vulnerable Software and Affected Versions** fast-mcp-telegram versions prior to 0.19.1 **Description** fast-mcp-telegram validates HTTP Bearer tokens by joining the raw token string into a session-file path. While the verifier rejects the exact reserved token `telegram`, it fails to reject path separators or normalize the path before checking for the session file's existence. A remote HTTP client can bypass reserved session name controls by using a traversal token such as `../fast-mcp-telegram/telegram` to authenticate as the default legacy session, provided the default session file `~/.config/fast-mcp-telegram/telegram.session` exists. This allows an unauthenticated network client to access the Telegram account associated with the default session file, enabling them to read and send messages, make MTProto API calls, and use other available tool surfaces. The issue exists within the `SessionFileTokenVerifier.verify token()` function. **Recommendations** Update to version 0.19.1. As a temporary mitigation, restrict the use of the `SessionFileTokenVerifier.verify token()` function or implement a filter to reject bearer tokens containing path separators like `/` or `` and traversal sequences like `..`.