CVE-2026-77519

Name of the Vulnerable Software and Affected Versions MaxKB versions prior to 2.10.2-lts

Description The authentication process for the '/chat/api/mcp' endpoint fails to enforce is permanent and expire time checks when validating an ApplicationApiKey. It only verifies the secret and active status. This allows a non-permanent application key that has expired but remains active to initialize the MCP endpoint, list tool metadata for published applications, invoke the 'tools/call' function, and create application chat and application chat record states, bypassing the restrictions enforced by the '/chat/api/open' endpoint.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.