NPM: CamoFox MCP: Unauthenticated HTTP MCP browser-control surface

NPM: CamoFox MCP: Unauthenticated HTTP MCP browser-control surface vulnerability discovered by ? in WordPress Npm camofox-mcp versions 1.13.2...

Missing Authentication for Critical Function

Overview camofox-mcp is an Anti-detection browser MCP server for AI agents — navigate, interact, and automate the web without getting blocked Affected versions of this package are vulnerable to Missing Authentication for Critical Function through the /mcp handler in src/http.ts. An attacker can...

PT-2026-45069

Unauthenticated HTTP MCP browser-control surface in camofox-mcp Summary camofox-mcp exposed a Streamable HTTP MCP endpoint at /mcp with rate limiting but no inbound MCP-layer authentication. When HTTP mode was enabled, any client that could reach /mcp could list and invoke browser-control tools. ...