The vulnerability in UnicomAI Wanwu allows an authenticated user to create AppKeys bound to any MCP server by supplying that server’s UUID in a POST request to /v1/appspace/app/key. This bypass of authorization (CWE‑639) gives the attacker the ability to open sessions on a victim’s MCP server and invoke the server's tools under the victim’s upstream authentication, effectively granting them administrative privileges without proper permission. The flaw resides in insufficient access checks on the key‑minting endpoint, enabling arbitrary target selection.

UnicomAI Wanwu software up through version 0.6.5 contains the flaw. The vendor has not released a fixed build in the provided data, so the only mitigation at this time is to upgrade to a later version where the authorization check is corrected.

The CVSS score of 2.3 indicates low severity, and no EPSS value is reported, implying a low likelihood of exploitation. The vulnerability is not listed in CISA KEV. Exploitation requires legitimate authentication to the service, after which an attacker can choose a victim’s server UUID and generate a key that gives them access to that server. Because the POST request is simple and requires no elevated privileges, the attack can be performed by any authenticated user within the same network.