MaxKB’s `/chat/api/mcp` endpoint authenticates application keys solely by the secret and active status, ignoring the `is_permanent` flag and `expire_time` checks used by the standard chat API. An expired, non‑permanent key that remains active can still reach the MCP route, permitting the attacker to list available tool metadata, invoke tools, and create persistent chat state records. This flaw allows an actor with access to such a key to perform unauthorized operations on the system, potentially exposing sensitive data or consuming resources without permission. The weakness aligns with CWE‑613, an authorization flaw where authentication information is insufficiently validated.

The vulnerability affects the open‑source AI assistant MaxKB from 1Panel‑dev, specifically versions 2.10.2‑lts and all earlier releases. No fixed version has been identified in the current advisory. Systems running these releases are at risk if they allow unauthenticated or improperly checked keys to access the `/chat/api/mcp` endpoint.

The CVSS score of 5.4 indicates a moderate severity; detailed exploit probability (EPSS) is not available, and the issue is not listed in the CISA KEV catalog. Exploitation requires possession of an expired but still active application key and the ability to send requests to the MCP endpoint, which can be accomplished remotely over the network. Although no public exploit has been documented, the lack of key expiration enforcement means that any compromised key can be reused until revocation. Administrators should treat this as a non‑critical but preventable privilege escalation risk.