CVE-2026-79537

metatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference IDOR in the MCP transport session dispatch. The session store getSession in session-lifetime-manager.ts is keyed only by the client-supplied mcp-session-id header with no owner, namespace, or endpoint binding, and the...

CVE-2026-79537: Authorization Bypass Through User-Controlled Key

metatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference IDOR in the MCP transport session dispatch. The session store getSession in session-lifetime-manager.ts is keyed only by the client-supplied mcp-session-id header with no owner, namespace, or endpoint binding, and the...

CVE-2026-79537

metatool-ai MetaMCP versions through 2.4.22 are vulnerable to an Insecure Direct Object Reference (IDOR) in the MCP transport session dispatch. The root cause is that the session store (getSession in session-lifetime-manager.ts) is keyed solely by the client-supplied mcp-session-id header without...

CVE-2026-79537

metatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference IDOR in the MCP transport session dispatch. The session store getSession in session-lifetime-manager.ts is keyed only by the client-supplied mcp-session-id header with no owner, namespace, or endpoint binding, and the...

CVE-2026-79537

metatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference IDOR in the MCP transport session dispatch. The session store getSession in session-lifetime-manager.ts is keyed only by the client-supplied mcp-session-id header with no owner, namespace, or endpoint binding, and the...

CVE-2026-79537

metatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference IDOR in the MCP transport session dispatch. The session store getSession in session-lifetime-manager.ts is keyed only by the client-supplied mcp-session-id header with no owner, namespace, or endpoint binding, and the...

PT-2026-102820

Name of the Vulnerable Software and Affected Versions metatool-ai MetaMCP versions 2.4.22 and earlier Description An insecure direct object reference IDOR exists in the MCP transport session dispatch. The session store, specifically the getSession function in session-lifetime-manager.ts, relies...

EUVD-2026-89362

metatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference IDOR in the MCP transport session dispatch. The session store getSession in session-lifetime-manager.ts is keyed only by the client-supplied mcp-session-id header with no owner, namespace, or endpoint binding, and the...

PT-2026-48541

Name of the Vulnerable Software and Affected Versions nebula-mesh versions prior to 0.3.2 Description Cookies in internal/web/session.go and internal/web/oidc.go are configured with HttpOnly and SameSite=Lax but lack the Secure attribute. This allows a session to be disclosed if a plaintext reque...

EUVD-2026-25348

A vulnerability exists in SenseLive X3050’s web management interface due to improper session lifetime enforcement, allowing authenticated sessions to remain active for extended periods without requiring re-authentication. An attacker with access to a previously authenticated session could continu...

CVE-2026-25720

A vulnerability exists in SenseLive X3050’s web management interface due to improper session lifetime enforcement, allowing authenticated sessions to remain active for extended periods without requiring re-authentication. An attacker with access to a previously authenticated session could continu...

CVE-2026-25720

A vulnerability exists in SenseLive X3050’s web management interface due to improper session lifetime enforcement, allowing authenticated sessions to remain active for extended periods without requiring re-authentication. An attacker with access to a previously authenticated session could continu...

PT-2026-34795

A vulnerability exists in SenseLive X3050’s web management interface due to improper session lifetime enforcement, allowing authenticated sessions to remain active for extended periods without requiring re-authentication. An attacker with access to a previously authenticated session could continu...

pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass)

Summary pyLoad caches role and permission in the session at login and continues to authorize requests using these cached values, even after an admin changes the user's role/permissions in the database. As a result, an already logged-in user can keep old revoked privileges until logout/session...

CVE-2026-33527 Parse Server: Session update endpoint allows overwriting server-generated session fields

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.57 and 9.6.0-alpha.48, an authenticated user can overwrite server-generated session fields such as expiresAt and createdWith when updating their own session via the REST...

CVE-2026-33527

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.57 and 9.6.0-alpha.48, an authenticated user can overwrite server-generated session fields such as expiresAt and createdWith when updating their own session via the REST...

CVE-2026-33527 Parse Server: Session update endpoint allows overwriting server-generated session fields

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.57 and 9.6.0-alpha.48, an authenticated user can overwrite server-generated session fields such as expiresAt and createdWith when updating their own session via the REST...

CVE-2026-33527

Parse Server is affected; prior to 8.6.57 and 9.6.0-alpha.48, an authenticated user could overwrite server-generated session fields (expiresAt, createdWith) on their own session via the REST API, bypassing the configured session lifetime and making a session effectively permanent. The issue has b...

GHSA-JC39-686J-WP6Q Parse Server's Session Update endpoint allows overwriting server-generated session fields

Impact An authenticated user can overwrite server-generated session fields such as expiresAt and createdWith when updating their own session via the REST API. This allows bypassing the server's configured session lifetime policy, making a session effectively permanent. Patches The fix blocks...

PT-2026-27482

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.57 Parse Server versions prior to 9.6.0-alpha.48 Description An authenticated user can modify server-generated session fields, such as expiresAt and createdWith, when updating their own session through the RE...