EUVD-2026-89362

metatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference IDOR in the MCP transport session dispatch. The session store getSession in session-lifetime-manager.ts is keyed only by the client-supplied mcp-session-id header with no owner, namespace, or endpoint binding, and the...

PT-2026-102820

Name of the Vulnerable Software and Affected Versions metatool-ai MetaMCP versions 2.4.22 and earlier Description An insecure direct object reference IDOR exists in the MCP transport session dispatch. The session store, specifically the getSession function in session-lifetime-manager.ts, relies...