PT-2026-64094

X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token Summary AuthInjectionMiddleware in meta-ads-mcp rejects HTTP MCP requests only when both auth token and pipeboard token are absent. Because extract token from headers does not recognise the X-Pipeboard-Token header, an attacker who...

PT-2026-60896

Name of the Vulnerable Software and Affected Versions meta-ads-mcp versions prior to 1.0.115 Description An authentication bypass exists in the AuthInjectionMiddleware within the meta-ads-mcp package. The middleware only rejects requests when both auth token and pipeboard token are absent. Howeve...