Product
The Model Context Protocol (MCP) TypeScript SDK between versions 1.24.0 and 1.32.0 contains an authorization flaw in the InMemoryTaskStore that permits cross-session unauthorized access to tasks.