CVE-2026-53709

MCP Context Forge is an MCP gateway and administrative platform. Prior to 1.0.2, mcpgateway/config.py and .env.example ship a known JWT SECRET KEY, while verify jwt token() accepts HS256 tokens signed with that key and get current user() creates a platform administrator when the token subject matches PLATFORM ADMIN EMAIL and REQUIRE USER IN DB is false. A remote unauthenticated attacker can therefore mint accepted administrator tokens without a database account. While the vulnerable signing key remains configured and the platform-admin bootstrap remains enabled, forged access survives password rotation, account deletion, and session revocation, allowing administrative disclosure, modification, and service disruption. This issue is fixed in version 1.0.2.