CVE-2026-55529 turns one call to startswith() into a browser-mediated attack on a local MCP server: because http://localhost.evil.example begins with http://localhost, a malicious webpage can drive tools/call against an unauthenticated agent running on the victim's own machine.
The CSRF check compares the form value only with a csrf cookie, without binding either value to the authenticated session. Header injection through search lets an attacker plant a matching pair before the victim submits the email change.
The server validates CSRF tokens without binding them to the session that issued them. A token from the attacker's account therefore remains valid when the victim's browser submits it with the victim's session cookie.
The email-change handler binds the csrf form token to the non-session csrfKey cookie rather than the login session. Response-header injection through the search endpoint can install an attacker-controlled matching token and cookie.
POST /my-account/change-email requires a csrf token, but the same endpoint accepts a token-free GET request. Supplying the email in the query string returns 302 and changes the account address.
The endpoint rejects GET and invalid CSRF tokens, yet accepts POST when the csrf parameter is omitted entirely. Removing the parameter returns 302 and completes the email change.
The /social-login flow reaches /oauth-callback and refreshes the session cookie without an explicit SameSite attribute. Chrome's two-minute Lax-by-default exception then permits a cross-site POST that changes the victim's email.
Although the endpoint rejects a plain GET, its _method=POST override performs the email change during top-level navigation. That method confusion allows the victim's SameSite=Lax session cookie to accompany a cross-site request.
The confirmation script appends postId to /post/ without blocking path traversal. A crafted ../my-account/change-email URL turns a cross-site visit into a same-site redirect, so the browser's Strict cookie accompanies the request.
An XSS flaw on the support sibling domain runs in the same site as the target and opens its WebSocket endpoint with the victim's Strict cookie. Sending READY exposes Carlos's chat history across the sibling-domain trust boundary.
The email-change endpoint authorizes a state-changing POST using only the browser's session cookie. With no anti-CSRF token or equivalent origin check, an external page can submit the request as the authenticated victim.