IntentKit (<= 2.6.3)

IntentKit versions 2.6.3 and earlier contain an authorization bypass vulnerability allowing unauthenticated actors to execute restricted, state-changing tools by bypassing intended ToolBindingMiddleware per-request scoping.