CVE-2026-55156

Name of the Vulnerable Software and Affected Versions token-optimizer-mcp versions prior to 5.1.0

Description The dashboard HTTP server lacks authentication middleware for the '/api/session-summary' and '/api/session-events' endpoints, allowing any network-accessible client to access them without credentials. These handlers use the sessionId query parameter to construct a filesystem path via path.join. Because Node.js normalizes directory traversal sequences (..), an unauthenticated attacker can read any .jsonl file reachable from the server's filesystem. This allows for the exfiltration of session logs containing tool invocations, hook outputs, and token usage data.

Recommendations Update to version 5.1.0. As a temporary mitigation, restrict network access to the dashboard HTTP server or implement a strict allowlist for the sessionId parameter to reject characters such as / and .