CVE-2026-62264

PDF Reader MCP is a Model Context Protocol server for reading PDF documents. In versions 2.2.0 and later prior to 3.0.1, when MCPTRANSPORT=http enables the opt-in HTTP server, @sylphx/pdf-reader-mcp reads MCPAPIKEY and logs that X-API-Key authentication is enabled but never validates the X-API-Ke...

CVE-2026-62264

The @sylphx/pdf-reader-mcp Model Context Protocol server (versions 2.2.0 through 3.0.1 ) contains a vulnerability where the opt-in HTTP transport (MCP_TRANSPORT=http ) fails to validate the X-API-Key header on incoming requests. Although the server logs that authentication is enabled, it only rea...

CVE-2026-62264 PDF Reader MCP: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY

PDF Reader MCP is a Model Context Protocol server for reading PDF documents. In versions 2.2.0 and later prior to 3.0.1, when MCPTRANSPORT=http enables the opt-in HTTP server, @sylphx/pdf-reader-mcp reads MCPAPIKEY and logs that X-API-Key authentication is enabled but never validates the X-API-Ke...

CVE-2026-62264: SylphxAI pdf-reader-mcp: PDF Reader MCP is a Model Context Protocol server for reading PDF documents

PDF Reader MCP is a Model Context Protocol server for reading PDF documents. In versions 2.2.0 and later prior to 3.0.1, when MCPTRANSPORT=http enables the opt-in HTTP server, @sylphx/pdf-reader-mcp reads MCPAPIKEY and logs that X-API-Key authentication is enabled but never validates the X-API-Ke...

CVE-2026-62264

When "@sylphx/pdf-reader-mcp" is run as an HTTP server "MCPTRANSPORT=http", it reads the "MCPAPIKEY" environment variable and logs "API key authentication enabled X-API-Key header" at startup, but it never validated the "X-API-Key" header on incoming requests. The key was read into a variable and...

@sylphx/pdf-reader-mcp: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY

Impact When @sylphx/pdf-reader-mcp is run as an HTTP server MCPTRANSPORT=http, it reads the MCPAPIKEY environment variable and logs API key authentication enabled X-API-Key header at startup, but it never validated the X-API-Key header on incoming requests. The key was read into a variable and...

GHSA-Q344-5V34-GM84 @sylphx/pdf-reader-mcp: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY

Impact When @sylphx/pdf-reader-mcp is run as an HTTP server MCPTRANSPORT=http, it reads the MCPAPIKEY environment variable and logs API key authentication enabled X-API-Key header at startup, but it never validated the X-API-Key header on incoming requests. The key was read into a variable and...

PT-2026-133262

Impact When @sylphx/pdf-reader-mcp is run as an HTTP server MCP TRANSPORT=http, it reads the MCP API KEY environment variable and logs API key authentication enabled X-API-Key header at startup, but it never validated the X-API-Key header on incoming requests. The key was read into a variable and...