MCP Predictable Session ID

The Model Context Protocol (MCP) uses the Mcp-Session-Id header to bind a sequence of requests to a single logical session between a client and an MCP server. When a server generates these identifiers with a predictable algorithm — a sequential counter, a timestamp, a low-entropy string, or a time-based UUID (UUID v1) — rather than a cryptographically secure pseudo-random number generator (CSPRNG), the resulting IDs become guessable.

An attacker who can observe a small number of issued session IDs (for example, by simply opening their own session) can infer the generation pattern and the range of IDs currently in use by other clients. They can then replay those IDs to take over another client's MCP session without needing any credentials of their own.

This vulnerability allows an attacker to:

• Hijack another client's MCP session
• Issue unauthorized tool calls
• Perform silent reconnaissance and exfiltrate data
• Gain privileges or assume the identity of a legitimate client

Suppose a server issues session identifiers by incrementing a counter:

Mcp-Session-Id: 1001
Mcp-Session-Id: 1002
Mcp-Session-Id: 1003

After observing two or three of its own sessions, an attacker can trivially enumerate active sessions (1000, 999, 1004, …) and replay them. The same problem applies to timestamp-derived IDs and to UUID version 1, which encodes the generation time and the host MAC address and therefore carries far less entropy than it appears to. A CSPRNG-backed value such as a UUID v4 (9f8c2a7e-4b1d-4c6a-9e2f-7d3b8a1c5e04) is not predictable in this way.

The issue can be found in the session-management logic of the MCP server, wherever Mcp-Session-Id values are generated.

• Use CSPRNG-backed identifiers. Generate session IDs with at least 128 bits of entropy using a cryptographically secure generator (for example, UUID v4 or SecureRandom.hex(32)). Never derive them from sequential counters, timestamps, or any deterministic function of observable state.
• Reject UUID v1. UUID version 1 encodes a timestamp and MAC address; use UUID v4 instead.
• Enforce a minimum length. Session IDs must be at least 128 bits (32 hex characters or equivalent) to resist brute-force.
• Rotate session IDs on privilege change. Issue a new session ID whenever the authentication context changes, such as on token refresh or re-authentication.

• CWE-340
• CWE-330
• CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

• https://cwe.mitre.org/data/definitions/340.html
• https://cwe.mitre.org/data/definitions/330.html
• https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/
• https://owasp.org/API-Security/editions/2023/en/0xa2-broken-authentication/