The flaw resides in AshAi’s MCP server origin validation logic, which accepts a request if the Origin header matches the Host header and the forwarded scheme is read from a raw X‑Forwarded‑Proto header without verifying a trusted proxy. An attacker can craft a malicious web page that sends requests with a spoofed Host and Origin that match, and sets X‑Forwarded‑Proto to "https". Under these conditions the server mistakenly treats the request as originated from a trusted source, enabling the malicious page to issue cross‑site requests to a user’s local MCP server using that user’s authenticated actor. This effectively allows the attacker to perform privileged actions on the victim’s behalf. The vulnerability can be exploited without TLS; it relies solely on DNS rebinding and header manipulation. Because the Host, Origin, and X‑Forwarded‑Proto values are attacker‑controlled, a victim who visits the attacker’s page can inadvertently allow the MCP server to accept requests that bypass its intended protection. This condition leads to a CVSS score of 7.4 (High), reflecting the possibility of executing privileged operations with minimal user interaction. Although the attack requires DNS control and a malicious page, the practical exploitation risk is moderate to high, especially for environments where the MCP server is exposed to browsers or untrusted networks. The issue is not listed in the CISA KEV catalog, and no EPSS score is available, so vigilance remains essential.

ash‑project’s AshAi. The defect is present in all releases from 0.8.0 up to, but not including, 1.0.0. Versions 1.0.0 and later contain a fix that restricts origin validation to localhost by default, forcing any other origins to be explicitly whitelisted via the allowed_origins configuration.

The CVSS score of 7.4 signals a high severity. Exploitation can be achieved by any user who loads a malicious web page that can set headers controlling Host, Origin, and X‑Forwarded‑Proto. The lack of a trusted‑proxy check means an attacker can perform the attack without TLS or a backend proxy. While the practical exploitation requires DNS rebinding and HTTP header manipulation, the potential impact of unauthorized actions or data exfiltration warrants immediate remediation. The vulnerability is not yet present in the CISA KEV catalog and no EPSS probability is reported.