Skip to content
OpenAdvisories

Vendor

ymw0407

1 known vulnerabilities.

Products

auth-fetch-mcp 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.4
    CVE-2026-49857

    auth-fetch-mcp has SSRF Protection Bypass via IPv4-mapped IPv6 Loopback

    auth-fetch-mcp is an MCP server that lets AI assistants fetch content from authenticated web pages. Version 3.0.1 implements SSRF protection in `assertSafeUrl()` (`src/security.ts`) to block requests to private and loopback addresses. However, the `isPrivateV…

    ymw0407 auth-fetch-mcp auth-fetch-mcp npm