Description
@andrea9293/mcp-documentation-server v1.13.0 documents that a Web UI starts automatically on port 3080. However, the Web UI/API appears to bind to all network interfaces by default (*:3080 / 0.0.0.0:3080) instead of localhost-only, and its document-management API endpoints do not require authentication.
Recommendation
Update the @andrea9293/mcp-documentation-server package to the latest compatible version. Followings are version details:
- Affected version(s): = 1.13.0
- Patched version(s): 1.13.1
References
Could your website be exposed too?
SmartScanner can check your website for @andrea9293/mcp-documentation-server: Web UI API binds to all interfaces without authentication by default and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Streamable HTTP mode exposes LINE Desktop read/send tools without MCP authentication - CVE-2026-49357
- PenPot MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE - CVE-2026-45805
- Claw Orchestrator is missing authentication for the component API Endpoint - CVE-2026-10281
- Microsoft Playwright MCP Server vulnerable to DNS Rebinding Attack; Allows Attackers Access to All Server Tools - CVE-2025-9611
You might also like:
See something that needs correcting? Let us knowUpdated July 18, 2026