The vulnerability is an Origin‑validation bypass in the MCP HTTP Stream where the server checks the origin header with a startswith match. An attacker can supply a controlled origin such as localhost.attacker.com that satisfies the localhost allowlist, allowing the request to be accepted without an API key. The allowed origin header trick lets a malicious script on a website send Content‑Type: text/plain requests without a preflight, landing on the tools/call endpoint. Because this endpoint writes files that persist agent instructions, the attacker can modify or inject instructions that the agent will later execute. The weakness fulfills CWE‑346 for improper restriction and CWE‑352 for cross‑site request forgery, and the impact is the ability to alter the agent’s persisted state without authentication.

Affected products are PraisonAI from MervinPraison. Versions prior to 4.6.58 contain the flaw. Versions 4.6.58 and newer apply an authoritative fix, addressing the Origin header validation logic.

The CVSS score of 7.6 indicates high severity. EPSS is not available, so the exact exploitation probability is unknown, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this by hosting a malicious web page that triggers a cross‑origin request to the tools/call endpoint; the request includes a text/plain body, satisfies the origin allowlist, and omits any required API key. Because no authentication is required and the request bypasses origin checks, the vulnerability can be abused from any device with network access to the Mop HTTP server.