al-ice.ai

The Check That Only Existed in the Log: AI Engine MCP Open Registration and PDF Reader Unchecked API Key

AI Vulnerabilities & CVEs by al-ice.ai Editorial

NVD published two High 7.5 MCP authentication failures on 30 October 2026, and they share an embarrassing shape: in both cases the software appeared to do access control while accepting the attacker. CVE-2026-110732 affects the AI Engine WordPress plugin through 3.8.6: its MCP module’s OAuth 2.1 Dynamic Client Registration endpoint is registered with permission_callback set to __return_true, so any unauthenticated visitor can register an active OAuth client with an attacker-controlled redirect URI and — once an administrator approves the client on the consent screen — walk away with an administrator-bound MCP access token and full admin-level control through the MCP tools. CVE-2026-62264 affects @sylphx/pdf-reader-mcp 2.2.0 through 3.0.1: with the opt-in HTTP transport enabled, the server reads MCP_API_KEY, logs that API-key authentication is active, and then never validates the X-API-Key header — so any client that can reach the port can invoke every PDF tool, over a default bind of 0.0.0.0. One flaw registers strangers, the other stops checking badges at the door.

AI Engine: open registration with an admin-grade payoff

The vulnerable endpoint is /wp-json/mcp/v1/oauth/register. Because registration requires no permission at all, an unauthenticated attacker can enroll a live OAuth client pointing at their own redirect URI. The remaining step is social: an administrator must approve the attacker’s client on the OAuth consent screen, at which point the attacker holds a token bound to the administrator and can drive MCP tools including user creation and option updates. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) prices that step honestly — attack complexity High, user interaction Required — and Strix’s listing of the record adds that the consent page is served without X-Frame-Options or Content-Security-Policy frame-ancestors, so the approval click is obtainable via clickjacking. NVD records CWE-862 (Missing Authorization), status Deferred, and references the vendor’s 3.8.7 tag changeset as the fix direction; EPSS sits near 0.27 percent over 30 days. This is the same neighborhood as September’s triple auth failure in another WordPress MCP plugin, including one-click admin creation — different plugin, same lesson about bolting MCP and OAuth onto WordPress without a permission model — and it extends October’s AI Engine editor media-helper object check story: the plugin keeps shipping fixes around its trust boundaries.

PDF Reader MCP: the key that was read and never checked

The PDF Reader flaw is the purer specimen. The fix commit message, read first-hand, states it plainly: the HTTP transport read MCP_API_KEY and logged API key authentication enabled but never checked the header, so any client that could reach the port could call every PDF tool and read any PDF the process can open — with the startup log actively reassuring the operator that protection was on. The fix (PR #332, commit 4c35f72, privately reported by novice-22) enforces X-API-Key on every /mcp request when the key is set, using a constant-time comparison with 401s on missing or mismatched keys, while keeping /mcp/health and CORS preflight open. It also flips the default bind from 0.0.0.0 to loopback 127.0.0.1, warns at startup when binding a non-loopback host with no key, and adds HTTP auth integration tests plus a security policy. NVD records CWE-200 with CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), the GitHub advisory GHSA-q344-5v34-gm84 was published 29 October 2026 with a SEMVER range of introduced 2.2.0, fixed 3.0.1, and the default stdio transport was never affected. Note the scope honesty in both vectors: PDF Reader’s AC:L/UI:N (no interaction needed) versus AI Engine’s AC:H/UI:R (an admin must click) — the easier flaw to trigger remotely is the one nodding along in the log line.

A crowded class with a telling tell

These two join a dense recent run of MCP authorization failures: AnkiMCP’s disabled DNS-rebinding protection (CVE-2026-61546), the Instatic and SurrealDB MCP auth pair (CVE-2026-121458, CVE-2026-121419), Chainlit’s semicolon SSRF past MCP allowlists (CVE-2026-120492), and the MCP Inspector OAuth callback RCEs. The shared tell is worth naming: authentication that is configured, logged, or displayed — and never enforced on the request path. Operators auditing MCP exposure should treat startup banners and dashboard toggles as claims, and verify each one with an unauthenticated request.

What to do

  • Update AI Engine past 3.8.6. Follow the vendor’s 3.8.7 tag changeset referenced by the NVD record, then audit OAuth client registrations for clients nobody on your team enrolled.
  • Update @sylphx/pdf-reader-mcp to 3.0.1. Set MCP_API_KEY, keep the loopback default unless the HTTP transport genuinely must listen wider, and never bind 0.0.0.0 without a key.
  • Prove auth with an unauthenticated request. Hit every MCP HTTP endpoint without credentials after each deploy; a 401 is the control, a log line is not.
  • Review pending OAuth consent grants. The AI Engine chain ends at an admin clicking approve — unexpected clients and clickjacking-hardening (frame ancestors) deserve the same attention as the patch.

We verified this briefing read-first-hand against both full NVD records (vectors, CWEs, references, and Deferred status above), the anymd fix commit and PR #332, the OSV entry for GHSA-q344-5v34-gm84 via the OSV API (SEMVER range, severity, references), and the Strix listing for CVE-2026-110732 (consent-screen precondition, clickjacking note, EPSS). The WordPress plugin changeset and Wordfence page were cited via the NVD record’s references only. We ran no server, crafted no OAuth client, and sent no unauthenticated requests.

Sources: