@andrea9293/mcp-documentation-server: Web UI API binds to all interfaces without authentication by default

Description

@andrea9293/mcp-documentation-server v1.13.0 documents that a Web UI starts automatically on port 3080. However, the Web UI/API appears to bind to all network interfaces by default (*:3080 / 0.0.0.0:3080) instead of localhost-only, and its document-management API endpoints do not require authentication.

Recommendation

Update the @andrea9293/mcp-documentation-server package to the latest compatible version. Followings are version details:

• Affected version(s): = 1.13.0
• Patched version(s): 1.13.1

References

• GHSA-6f5r-5672-72j7
• CVE-2026-54504
• CWE-306
• CWE-668
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6
• OWASP 2021-A7

Related Issues

• Streamable HTTP mode exposes LINE Desktop read/send tools without MCP authentication - CVE-2026-49357
• PenPot MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE - CVE-2026-45805
• Claw Orchestrator is missing authentication for the component API Endpoint - CVE-2026-10281
• Microsoft Playwright MCP Server vulnerable to DNS Rebinding Attack; Allows Attackers Access to All Server Tools - CVE-2025-9611

You might also like:

Exploiting Server Version Disclosure

How AI and Machine Learning are Revolutionizing Web Security

How do hackers hack websites?

Tags:

npm

@andrea9293/mcp-documentation-server