Description

Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants run Meta Ads. Prior to version 1.0.109, `AuthInjectionMiddleware.dispatch()` at `http_auth_integration.py:272` unconditionally forwards unauthenticated Streamable HTTP requests to downstream MCP tool handlers without issuing a `401` response, allowing any network-reachable caller to invoke MCP tools without authentication. When no per-request credential is present, tool handlers fall back to the `META_ACCESS_TOKEN` environment variable, and when the downstream Meta Graph API call fails, `api.py:263–269` serialises the raw `httpx` request URL—including the operator's `access_token` as a query parameter—into the JSON-RPC response body, delivering the credential to the unauthenticated caller. Version 1.0.109 fixes the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-07T20:16:51.723Z",
  "pubdate": "2026-08-07T20:16:51.723Z",
  "executiveSummary": "Meta Ads MCP prior to version 1.0.109 suffers from an authentication bypass vulnerability coupled with sensitive credential exposure. The flaw resides within the AuthInjectionMiddleware.dispatch() method located at http_auth_integration.py:272, which unconditionally forwards unauthenticated Streamable HTTP requests directly to downstream Model Context Protocol tool handlers without returning a 401 Unauthorized response. Consequently, any network-reachable unauthenticated caller can invoke privileged MCP tools. Furthermore, when downstream Meta Graph API interactions fail, api.py:263–269 serializes the raw httpx request URL—which includes the operator's private access_token as a query parameter—directly into the JSON-RPC response body, thereby leaking the administrative credential back to the unauthorized requester. This combination permits remote, network-adjacent attackers to execute arbitrary Meta Ads operations and harvest valid tokens without holding any prior privileges or authentication credentials.",
  "technicalDetails": "The vulnerability stems from flawed security middleware logic within the Meta Ads MCP server prior to version 1.0.109. Specifically, the AuthInjectionMiddleware.dispatch() function, implemented in http_auth_integration.py at line 272, fails to validate incoming requests properly. Instead of intercepting unauthenticated requests and issuing a 401 HTTP response code, the middleware unconditionally forwards incoming Streamable HTTP requests to downstream Model Context Protocol tool handlers.\nWhen requests lack per-request user credentials, the affected tool handlers automatically fall back to utilizing a globally configured fallback credential stored in the META_ACCESS_TOKEN environment variable. Because the endpoint is network-reachable and completely lacks access control enforcement, any unauthenticated attacker can invoke sensitive tool handlers.\nThe exploitation vector is further exacerbated by verbose error handling mechanisms located in api.py across lines 263 through 269. When a downstream call to the Meta Graph API fails, the application captures and serializes the raw httpx request URL into the outgoing JSON-RPC response body. Because the API constructs requests by appending the operator's secret access_token as a query parameter, the raw token is returned directly to the unauthenticated caller in the error payload.\nThe attack flow proceeds as follows: First, an unauthenticated network-reachable attacker transmits a crafted Streamable HTTP request targeting the MCP server. Second, AuthInjectionMiddleware.dispatch() bypasses validation and routes the request to the tool handlers. Third, lacking per-request parameters, the tools execute using the environment-level META_ACCESS_TOKEN. Fourth, if the API interaction triggers a failure condition, the error handler at api.py:263–269 exposes the raw request URL containing the access token within the JSON-RPC response, completing both unauthorized tool execution and credential exfiltration."
}