Min8282

The HTTP mode of @tsparticles/mcp-server accepts unauthenticated POST requests at the '/mcp' endpoint. The system accumulates every request-body chunk in a `Buffer[]` without a cumulative size limit before executing `Buffer.concat` and `JSON.parse()`. A remote attacker can stream an arbitrarily large body to exhaust Node.js process memory, leading to service termination. This includes the official Docker configuration that exposes HTTP mode on 0.0.0.0:3000.

When running with `OBOT SERVER ENABLE AUTHENTICATION=true`, the software exposes OAuth dynamic client registration without authentication and without restrictions on redirect URIs. This allows an unauthenticated attacker to register a client pointing to an external domain. Because the authorization flow auto-completes for logged-in users without a consent screen, an attacker can induce a victim to visit a crafted authorization URL to receive an authorization code at the attacker-controlled redirect URI, which is then exchanged for an access token and refresh token. The token minted by the MCP OAuth flow includes the victim's full group set in the JWT (JSON Web Token), a format for securely transmitting information. Since the system validates the issuer but not the audience, the token is accepted as a bearer token against any Obot API endpoint the victim can access, rather than being scoped to the requested MCP server. This enables the attacker to read or modify the victim's resources until the token is revoked.