Executive brief
Token Optimizer MCP is a Node.js dashboard server that manages session logs and token usage data. Two unauthenticated API endpoints allow attackers to read any `.jsonl` file on the server by injecting directory traversal sequences into a session ID parameter, exposing sensitive operational data including tool invocations, authentication tokens, and hook outputs without requiring any credentials.
Technical details
This is a path traversal vulnerability (CWE-22) affecting the `/api/session-summary` and `/api/session-events` endpoints in Token Optimizer MCP. Both endpoints accept an unsanitized `sessionId` query parameter and concatenate it directly into a filesystem path via `path.join(hooksDataPath, \`session-log-${sessionId}.jsonl\`)`, then read the file with `fs.readFileSync`. Node.js normalizes `..` path traversal sequences during resolution, allowing an attacker to escape the intended `hooksDataPath` directory. The endpoints have no authentication middleware, making them reachable from the network without credentials. An attacker can craft requests such as `GET /api/session-events?sessionId=abc/../../../../traversal-target` to read `.jsonl` files anywhere on the filesystem accessible to the server process. A proof-of-concept confirms successful exfiltration of files outside the intended directory. Patch version 5.1.0 is available.
Affected products
- ooples token-optimizer-mcp < 5.1.0
Timeline
- 2026-08-14: disclosed: GHSA advisory published
- 2026-08-14: patched: Version 5.1.0 released with fix