H3-2026-1103¶
ShowDoc Model Context Protocol Authentication Bypass Vulnerability
| Category | VULNERABILITY |
| Base Score | 9.8 |
Description¶
ShowDoc sets the request path used by its Model Context Protocol controller inside mcp.php, where that controller enforces Bearer token checks. The underlying server/index.php entry point overrides this routed path whenever the s query parameter is present, substituting an attacker chosen path before the token check runs. Remote attackers can supply an arbitrary internal controller and method through the overridden path, reaching application API endpoints without any token. Exploitation requires only network access to the mcp.php entry point, since the override logic executes regardless of the caller supplying a token.
Impact¶
Remote attackers can invoke internal ShowDoc API controllers and retrieve application configuration data without credentials. Exposed data includes registration settings and AI service status, which can inform further targeted attacks. Any internet reachable ShowDoc instance is affected regardless of deployment scale.