Meta Ads MCP allows any network‑reachable caller to invoke MCP tools without providing authentication. In the affected versions the server falls back to an environment variable named META_ACCESS_TOKEN, and when a downstream Meta Graph API call fails, the raw HTTP request URL—including the access token as a query parameter—is serialized into the JSON‑RPC response body. The result is that an unauthenticated attacker can obtain a live Meta access token and potentially control the operator’s Meta Ads account. The flaw corresponds to CWE‑287: Authentication Bypass.

The vulnerability affects Meta Ads MCP deployments running before version 1.0.109, as provided by pipeboard‑co.

With a CVSS score of 9.1 the vulnerability is considered critical. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. The attack vector is any remote entity that can reach the MCP server’s HTTP interface, which is typically accessible from machines within the same network or from the public internet if not otherwise restricted.