DeepSeek MCP Server is an MCP server for DeepSeek V4. Starting in version 1.4.2 and prior to version 1.7.0, the process-global `SessionStore` accepts caller-supplied `session_id` values without binding them to any authenticated principal or transport session. An attacker can enumerate active session IDs via `deepseek_sessions`, then reuse a victim-controlled `session_id` in `deepseek_chat` to retrieve and continue the victim's conversation context. Version 1.7.0 contains a patch.

Affected: npm: @arikusi/deepseek-mcp-server

# Cross-Session Data Exposure via Caller-Controlled `session_id`

Project / Repository: `arikusi/deepseek-mcp-server` Affected version / commit tested: `1.6.0` / `04f28be2c6e99d3d4e443a6ae37cc35f0a71554a` Vulnerability type: Authorization bypass / cross-session data exposure Authentication required: No

## Summary The process-global `SessionStore` accepts caller-supplied `session_id` values without binding them to any authenticated principal or transport session. An attacker can enumerate active session IDs via `deepseek_sessions`, then reuse a victim-controlled `session_id` in `deepseek_chat` to retrieve and continue the victim's conversation context.

## Affected Code - `src/session.ts:42` - caller-controlled session IDs are looked up directly from the global in-memory map. - `src/session.ts:67` - a new session is stored under the caller-controlled ID without ownership binding. - `src/session.ts:109` - `getMessages()` retrieves messages for any supplied session ID. - `src/tools/deepseek-chat.ts:195` - `deepseek_chat` creates or reuses the supplied `session_id`. - `src/tools/deepseek-chat.ts:197` - previous messages are loaded from the supplied `session_id`. - `src/tools/deepseek-chat.ts:198` - previous messages are prepended into the attacker-controlled request. - `src/tools/deepseek-chat.ts:243` - attacker-provided user messages are appended into the reused session. - `src/tools/deepseek-chat.ts:245` - assistant responses are appended back into the reused session. -…