An MCP session restored through a weaker route retained a privileged backend

The MCP proxy restored the original backend from a session identifier while the current request could enter by another route. The scope parsing path admitted unverified claims, so a valid low-scope session and a permissive alternate route were enough for the controlled test to access the protected tool.

The demonstration used selected route configurations and a synthetic backend, not an audited production Envoy cluster. It does not establish anonymous internet access or malicious customer operations.

The attack combines two weak checks rather than one universal JWT bypass. A legitimate session started on OAuth-protected route A; a separate route B could then carry its session ID without binding the active route to the original route. The resumed session used claims parsed without signature verification under the original route configuration. The local demonstration exercised the proxy handler and a test backend, not a deployed Envoy and Kubernetes chain, so the configuration prerequisites remain essential to the finding.