Authentication bypass in meta-ads-mcp AuthInjectionMiddleware (CVE-2026-54547)

An authentication bypass vulnerability in `AuthInjectionMiddleware` within the `meta-ads-mcp` package allows an unauthenticated network attacker to send an HTTP request bearing only the `X-Pipeboard-Token` header with any arbitrary value, causing the middleware guard to pass without setting an authentication context. The server then falls back to the operator's `META_ACCESS_TOKEN` environment variable, enabling the attacker to read and write the operator's Meta Ads data using the operator's credentials. Affected versions: - <= 1.0.113 We recommend updating to: 1.0.115. CVSS 7.4 · our assessment: this_week Vendor advisory: https://github.com/pipeboard-co/meta-ads-mcp/security/advisories/GHSA-2v2f-mvfg-ph56 Details: https://vuln.today/cve/CVE-2026-54547