Attack Chain

1. An unauthenticated attacker sends an HTTP POST request to the /mcp endpoint, including an X-Pipeboard-Token header with an arbitrary value.
2. The AuthInjectionMiddleware in meta_ads_mcp/core/http_auth_integration.py evaluates its guard condition (if not auth_token and not pipeboard_token). Because auth_token is None (as X-Pipeboard-Token is not recognized by extract_token_from_headers()) and pipeboard_token is truthy (due to the presence of X-Pipeboard-Token), the condition evaluates to False, bypassing the intended authentication check.
3. No proper authentication context is established for the incoming request within the application.
4. During subsequent processing, when an access token is required, the application's token getter (http_auth_integration.py:163-168) defaults to the original token accessor due to the lack of an auth_token.
5. The auth.py module (auth.py:446-453) retrieves the META_ACCESS_TOKEN from the server's environment variables.
6. This operator's META_ACCESS_TOKEN is then automatically injected into the access_token keyword argument for any invoked meta_api_tool (e.g., api.py:390-396).
7. The targeted tool, such as accounts.py:42-62 (get_ad_accounts), makes an API call to the Meta Graph API using the operator's META_ACCESS_TOKEN.
8. httpx.AsyncClient (api.py:225-235) sends a privileged HTTP request to the Meta Graph API, allowing the attacker to read and write Meta Ads data with the operator's permissions.

Impact

Successful exploitation of this authentication bypass allows an unauthenticated network-reachable attacker to fully compromise the meta-ads-mcp instance. The attacker gains the ability to read all Meta Ads data (including ad accounts, campaigns, creatives, audiences, and insights) accessible to the server operator. Furthermore, the attacker can write and modify Meta Ads resources, such as creating or updating campaigns and budgets, effectively taking control of the operator's advertising accounts. There is also a risk of exfiltrating the operator's identity through Meta Graph API error responses that might reference the compromised token. This vulnerability directly affects operators using meta-ads-mcp in streamable-http mode with a configured META_ACCESS_TOKEN.

Recommendation

• Enable comprehensive webserver logging that captures all HTTP request headers for all HTTP POST requests to the /mcp endpoint.
• Review webserver logs for HTTP POST requests to the /mcp endpoint containing the X-Pipeboard-Token header, as this indicates an attempted authentication bypass.