All vulnerabilities

GHSA-vr58-8mmm-pg6c

mastyf.ai: dashboard MCP bridge bypasses authentication, granting unauthenticated tool execution

criticalCVSS 10.0CWE-306

Vendor

mastyf-ai

Package

@mastyf_ai/server npm

Affected

<= 4.1.12

Fixed in

4.1.13

Disclosed

2026-09-19

Credit

Avishai Gonen

auth-bypassdns-rebindingmcp

Published advisory