oatpp MCP Session Hijacking Vulnerability

A vulnerability in the oatpp-mcp component allows network attackers with access to the oatpp-mcp server to hijack legitimate client MCP sessions. The issue arises because the MCP SSE endpoint returns an instance pointer as the session ID, which lacks uniqueness and cryptographic security. This flaw enables attackers to guess future session IDs and intercept sessions, potentially leading to the execution of malicious responses from the oatpp-mcp server.

Impact

Exploitation of this vulnerability allows for session hijacking, where an attacker can take over a legitimate user's MCP session and manipulate the interaction with the oatpp-mcp server.