The Model Context Protocol TypeScript SDK uses a stateless HTTP transport or a single server instance to service multiple clients. When a shared transport or server is reused, the SDK associates messages with a JSON‑RPC request identifier only, and client code resets the identifier counter to zero. This permits a race condition where two concurrent clients generate the same request ID, causing responses and notifications to be delivered to the wrong recipient. The result is cross‑client leakage of data that may contain sensitive information, representing a confidentiality breach. The weakness is identified as CWE‑362.

Vendors affected include @modelcontextprotocol/server versions 2.0.0 through 2.3.0 and the TypeScript SDK that depends on it. Any application that constructs a single @modelcontextprotocol/server or HTTP transport instance at startup and exposes an MCP server over HTTP to multiple clients is susceptible. Standard stdio servers and factory‑created per‑call servers are not impacted.

The vulnerability carries a CVSS score of 7.7 and is not listed in the CISA KEV catalog. Although EPSS data is not available, the requirement for a shared HTTP endpoint and reusable server instance is common in web application deployment, suggesting a moderate to high likelihood of exploitation. The likely attack vector is remote network access to the HTTP endpoint, where an attacker can send concurrent requests from multiple clients or craft a single client that triggers ID collisions. Successful exploitation would result in confidential data disclosure across client sessions.