AIKIDO-2026-153689

TL;DR

The standalone HTTP server in the LangWatch MCP server, reachable only when the non-default --http transport is enabled, authorizes requests using just a session identifier without revalidating the bearer API key that issued the session. It also accepts API keys in the SSE query string, returns a wildcard Access-Control-Allow-Origin without validating the Origin header, binds beyond loopback, and never expires sessions or caps how many any bearer token may allocate. Someone who obtains a valid session identifier through a side channel can invoke platform tools such as creating and revoking API keys, while the permissive CORS and query-string key handling expose credentials to browsers, logs, and proxies. The fix ties sessions to their issuing credential, revalidates bearer keys before allocation, validates origins and removes wildcard CORS, binds to loopback by default, drops URL-based API key parameters, and enforces session expiration and allocation limits.