MCP Session ID as Authentication

An MCP server is expected to treat the Mcp-Session-Id header as a reference to a session that must still be authenticated on every request — not as proof of identity in itself. This vulnerability occurs when the server accepts requests carrying a valid Mcp-Session-Id without re-verifying that the request also presents the original authentication context (Bearer token or session cookie) that created the session.

Once the session ID is known — through interception, log exposure, or client-side leakage — it functions as a self-sufficient bearer credential: any party holding it can replay MCP calls with no password, token, or cookie of their own. In effect, the Mcp-Session-Id is the authentication.

This vulnerability allows an attacker to:

• Gain full access to MCP operations using only a captured session ID
• Persist access across re-authentication of the legitimate user
• Exfiltrate AI context and conversation data
• Issue unauthorized tool calls under the victim's identity

A client authenticates and receives a session:

POST /mcp HTTP/1.1
Authorization: Bearer eyJhbGciOi...
Mcp-Session-Id: 9f8c2a7e-4b1d-4c6a-9e2f-7d3b8a1c5e04

An attacker who has learned the session ID replays the request with the Authorization header removed:

POST /mcp HTTP/1.1
Mcp-Session-Id: 9f8c2a7e-4b1d-4c6a-9e2f-7d3b8a1c5e04

If the server still returns a successful MCP response, it is relying on the session ID alone and does not re-verify the authentication context — confirming the vulnerability.

The issue can be found in the request-authorization logic of the MCP server, on every endpoint that accepts an Mcp-Session-Id.

• Bind sessions to identity. On every MCP request, verify that the Authorization (or equivalent auth) header corresponds to the same identity that created the session, and reject requests where the identity does not match.
• Re-validate on every request. Do not treat session creation as a one-time authentication event. Maintain a server-side map of {session_id → user_identity} and enforce it on each call.
• Invalidate on auth context change. Destroy the MCP session when the underlying auth token expires, is revoked, or the user logs out. Do not allow stale sessions to outlive the authentication that created them.
• Use short-lived sessions. Apply absolute session timeouts (for example, 15–60 minutes) independent of activity, so a captured session ID decays quickly.

• CWE-294
• CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

• https://cwe.mitre.org/data/definitions/294.html
• https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/
• https://owasp.org/API-Security/editions/2023/en/0xa2-broken-authentication/