MCP Lack of Session Invalidation

Details

Severity: Medium
Test Name: MCP Lack of Session Invalidation
Test ID: mcp_session_not_invalidated

Description

The Model Context Protocol allows a client to terminate a session by sending an HTTP DELETE request carrying the Mcp-Session-Id. This vulnerability occurs when the server returns an HTTP 2xx response to that DELETE — indicating the session was terminated — but does not actually remove the session from its registry. The same session ID remains functional after the purported deletion.

This is a false contract: clients and orchestration systems that call DELETE to clean up sessions receive confirmation of a deletion that never happened, while the session persists as a live credential that can still be used to make MCP calls.

Impact

This vulnerability allows an attacker to:

Exploit a false sense of security created by confirmed-but-ineffective logout
Retain access to a session after it was supposedly terminated
Keep using a long-lived credential that should no longer be valid

Examples

A client terminates its session and the server confirms it:

DELETE /mcp HTTP/1.1
Mcp-Session-Id: 9f8c2a7e-4b1d-4c6a-9e2f-7d3b8a1c5e04

HTTP/1.1 204 No Content

A subsequent request that reuses the same session ID should now be rejected. If the server still honours it, the session was never actually invalidated:

POST /mcp HTTP/1.1
Mcp-Session-Id: 9f8c2a7e-4b1d-4c6a-9e2f-7d3b8a1c5e04

HTTP/1.1 200 OK

A correctly behaving server returns HTTP 401 with JSON-RPC error -32002 ("invalid session id") once the ID has been deleted.

Locations

The issue can be found in the session-termination logic of the MCP server, specifically in the DELETE handler and its interaction with the session registry.

Remediation suggestions

Honour accepted DELETE termination. If the server returns HTTP 2xx to a DELETE request carrying Mcp-Session-Id, remove that session from the server-side registry immediately. Return HTTP 200 or 204 only after the session has been removed.
Verify termination atomically. The DELETE handler and the request handler must share the same session registry (same datastore, same lock); eventual consistency is not acceptable for session invalidation.
Propagate termination across nodes. In horizontally scaled deployments, broadcast session deletion to all nodes immediately.
Apply absolute session timeouts. Even without explicit termination, sessions must expire after an absolute lifetime limit (for example, 8 hours) and an inactivity timeout (for example, 15 minutes), and expired sessions must be removed from the registry.
Return 401 on reuse. After DELETE is processed, return HTTP 401 with JSON-RPC error -32002 ("invalid session id") if the deleted ID is reused.

Classifications

CWE-613
CWE-672
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References