PDF Reader MCP is a server that supports PDF document processing. In vulnerable configurations, the HTTP transport accepts requests without validating the X-API-Key header, despite startup logs indicating authentication is enabled. This flaw allows an attacker to invoke any PDF tool and retrieve the contents of PDFs that the server process can access, leading to unauthorized disclosure of potentially sensitive documents. The weakness represents a classic authentication bypass (CWE-287) and results in information disclosure (CWE-200). In addition, the open `/mcp` endpoint can be used for limited server‑side request forgery when source URLs are supplied. The attack surface is narrow: the server must be exposed on an accessible network interface, and the client must know the service endpoint.

The affected vendor is SylphxAI, with the product pdf‑reader‑mcp. Versions starting at 2.2.0 up to, but not including, 3.0.1 contain the vulnerability. Version 3.0.1 and later include a fix that properly validates the X‑API‑Key header when the HTTP server is enabled.

The product carries a CVSS score of 7.5, indicating a high severity. The EPSS score is not available, so the current probability of exploitation cannot be quantified, but the flaw is non‑trivial and the server may be reachable on the default 0.0.0.0 bind address. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers who can reach the affected service can read arbitrary PDF files and induce limited server‑side request forgery if URLs are supplied; there are no special preconditions beyond network access to the open port.