Medium 6.5Published Jun 30, 2026

CVE-2026-58446Presenton < 0.8.8-beta - Authentication Bypass of Session Auth via Unprotected MCP Endpoint

Updated under an hour ago (Oct 26, 2026, 7:00 PM ET)

Does this affect you?

It affects presenton. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for presenton

Exploited in the last 30 days

Presenton before 0.8.8-beta bundles an MCP server that, on server/Docker deployments configured with session authentication (AUTH_USERNAME/AUTH_PASSWORD), is reachable unauthenticated at /mcp because the nginx front-end does not apply the auth_request gate to that path and the MCP server auto-mints a valid internal session token for the configured user. A remote unauthenticated attacker can invoke MCP tools such as generate_presentation, performing authenticated application actions, consuming the operators configured LLM API keys, and creating presentations in the operators instance. The Electron desktop build is not affected (MCP disabled).

CVSS: 6.5 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness (CWE): CWE-306
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulnCheck
NVD analysis: Deferred
Record last updated: Jul 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

presenton presenton presenton:presenton (from the name)	before 0.8.8-beta	CNA record

References

References

https://github.com/presenton/presenton/releases/tag/electron-v0.8.8-beta	release-notes
https://github.com/presenton/presenton/issues/678	technical-description, exploit
https://github.com/presenton/presenton/pull/679	issue-tracking
https://github.com/presenton/presenton/commit/a1103dcef3c761cc8bab44e2862c81a49969abd7	patch
https://www.vulncheck.com/advisories/presenton-beta-authentication-bypass-of-session-auth-via-unprotected-mcp-endpoint	third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.