One post tagged with "security"

Until version 4.0.0 this server bound to every network interface, accepted any browser origin, and required no credential on any of its 45 routes. Anyone on the same Wi-Fi could drive it. Any web page you visited could drive it too.

Someone reported it. We fixed it, published the advisory, and then found a second hole of the same family a few weeks later. Here is what we learned, written down because the pattern is not ours alone — researchers scanning public MCP servers keep finding the same three mistakes.