MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay
The Ruby SDK's streamable_http_transport.rb implementation contains a session hijacking vulnerability. An attacker who obtains a valid session ID can completely hijack the victim's Server-Sent Events (SSE) stream and intercept all real-time data.