The flaw lies in the addMcpServer function of the NextChat codebase. It allows an attacker to bypass normal authorization checks and add a merge‑control‑proxy server without permission. This gives the attacker elevated privileges, enabling the creation of new server endpoints, potentially leading to further exploitation or compromise of the web application and any integrated services.

The vulnerability exists in ChatGPTNextWeb’s NextChat application up through version 2.16.1. All installations using those or earlier releases are susceptible; anything beyond 2.16.1 is unaffected if the fix has been included.

With a CVSS score of 6.9, the risk is considered medium. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers would likely exploit it remotely via a crafted HTTP request to the addMcpServer endpoint; no local privilege or physical access is required. Once authorized, the attacker could add arbitrary servers, providing a foothold for further damage.