Skip to main content
The MCP server allows connections without verifying the client/user identity.

​
How to resolve

Implement strong authentication: Require all clients to authenticate using strong mechanisms such as API keys, OAuth 2.0 tokens, mutual TLS (mTLS), or certificate-based authentication. Never deploy servers without authentication in production environments. Use secure credential storage: Store authentication credentials securely using secrets management systems. Avoid hardcoded credentials, default passwords, or credentials stored in configuration files. Enforce authentication at all entry points: Ensure every exposed interface and endpoint requires authentication. Do not assume network-level security is sufficient. Implement authentication monitoring: Log all authentication attempts (successful and failed) and monitor for brute-force attacks, credential stuffing, or other suspicious patterns. Set up alerts for repeated failed authentication attempts.

​
Risk

Governance/Compliance Missing or weak authentication vulnerabilities violate multiple security standards:
  • NIST AI RMF (GOVERN-4.1): Fails to enforce access control policies and does not ensure data provenance through verified identity of connecting clients.
  • ISO/IEC 42001 (Identity and Access Management): Does not implement identity and access management controls required for AI management systems handling sensitive operations.
  • OWASP MCP Top 10 (MCP07:2025 - Insufficient Authentication & Authorization): Allows unauthorized access to MCP servers due to missing or weak authentication mechanisms.
  • NIST Cybersecurity Framework 2.0 (PR.AA): Does not implement identity management and access control measures to ensure users can only perform actions within their authorized scope.
Security Missing or weak authentication is a critical vulnerability that allows any actor to connect to the MCP server and invoke its tools. This enables unauthorized data access, command execution, and resource manipulation. Attackers can exploit unauthenticated servers to steal sensitive information, execute malicious operations, or use the server as a pivot point for further attacks. Without authentication, there is no accountability trail, making incident response and forensics significantly more difficult.

​
Explanation

Missing or weak authentication enables unauthorized actors to connect to the server, invoke tools, and access resources without proving their identity, creating a critical security gap in the server’s exposed interface.

​
Specifications

Trigger
  • MCP server scan detects exposed interfaces that lack authentication mechanisms or use weak authentication schemes (hardcoded tokens, basic auth without TLS, or no credential verification)
Severity
  • CRITICAL
Applies to: MCP Server