MEDIUM 5.3 GitHub
CVE-2026-55156
Token Optimizer MCP: Unauthenticated Path Traversal in Dashboard Session Log API Endpoints
# Unauthenticated Path Traversal in Dashboard Session Log API Endpoints
| Field | Value |
| ---------------- | ----- |
| Repository | ooples/token-optimizer-mcp |
| Affected version | 5.0.1 (commit 8137147) |
| Vulnerability | CWE-22 — Improper Limitation of a Pathname to a Restricted Directory |
| Severity | Medium |
| CVSS 3.1 | 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) |
## Summary
The dashboard HTTP server in `token-optimizer-mcp` exposes `/ap
Affected Products
- npm/@ooples/token-optimizer-mcp < 5.1.0
References
- https://github.com/advisories/GHSA-76pc-mqxp-3rq5
- https://github.com/ooples/token-optimizer-mcp/security/advisories/GHSA-76pc-mqxp-3rq5
- https://github.com/ooples/token-optimizer-mcp/commit/b4ee96dac799cbfba0a9f9c17844ce9d613cb
- https://github.com/ooples/token-optimizer-mcp/releases/tag/v5.1.0
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-08-14 via GitHub. Affected: npm/@ooples/token-optimizer-mcp < 5.1.0.
vulnfeed aggregates 10939 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.