This vulnerability allows an unauthenticated attacker to access the internal MCP endpoint /mcp, which automatically issues a valid session token for the configured operator user. The attacker can then invoke MCP commands such as generate_presentation, enabling them to perform privileged actions, consume the operator’s LLM API keys, and create presentations as if they were authenticated. The flaw is a classic authentication bypass, classified as CWE‑306, and results in unauthorized access to sensitive operations through the application’s own server. The potential impact includes data leakage and service disruption across the entire operator instance.

Products affected are Presenton before version 0.8.8‑beta on server or Docker deployments that enable session authentication via the environment variables AUTH_USERNAME and AUTH_PASSWORD. The Electron desktop build is not impacted because MCP is disabled in that configuration.

The CVSS score of 6.9 places this vulnerability in the moderate severity range, and the EPSS score is not available, indicating no current data on exploitation probability. The attack vector is inferred to be remote and unauthenticated due to the open /mcp endpoint; no KEV listing suggests no well‑known exploits have surfaced yet. Nevertheless, the flaw provides a clear path to elevated privileges, making it a significant risk especially in environments where the operator’s LLM keys need protection.