{"action":"Upgrade auth-fetch-mcp to 3.0.2 or later.","affected":[{"fixed":"3.0.2","introduced":"0"}],"component":"auth-fetch-mcp","cve_ids":["CVE-2026-49857"],"ecosystem":"npm","epss":0.00488,"exploited":false,"fixed_versions":["3.0.2"],"ghsa_id":"GHSA-pvrj-8cg3-j5f8","id":"tcs_01M5KG4GMPDNF70XD4PF4Z52Y6","modified_at":"2026-07-01T18:41:31.529770Z","published_at":"2026-07-01T18:16:22Z","references":["https://osv.dev/vulnerability/GHSA-pvrj-8cg3-j5f8","https://github.com/ymw0407/auth-fetch-mcp/security/advisories/GHSA-pvrj-8cg3-j5f8","https://github.com/ymw0407/auth-fetch-mcp"],"severity":{"label":"high","score":7.4},"sources":[{"source":"osv","source_id":"GHSA-pvrj-8cg3-j5f8","url":"https://osv.dev/vulnerability/GHSA-pvrj-8cg3-j5f8"}],"summary":"auth-fetch-mcp has SSRF Protection Bypass via IPv4-mapped IPv6 Loopback"}