Missing authentication for a critical function in Azure MCP Server allows an unauthorized attacker who can reach the server over a network to read sensitive information. The flaw falls under the missing authentication weakness (CWE-306) and can lead to a serious breach of confidentiality by exposing data that Azure Web Apps stores or processes. The impact is equivalent to that of an authenticated user, giving attackers the same level of access to the system's data.

Microsoft Azure Web Apps is the affected product. No specific version numbers are listed, so any deployment that includes the MCP Server component may be vulnerable until a patch is applied.

The vulnerability has a CVSS base score of 9.1, indicating a critical level of risk. The EPSS score is below 1%, suggesting a low probability of current exploitation, and it is not listed in the CISA KEV catalog, meaning no known public exploitation. Attackers can exploit the flaw from any network location that can reach the MCP Server, as no authentication is required, lowering the barrier to exploitation. Prompt patching is therefore essential.