Presenton vulnerabilities

A security vulnerability has been detected in Presenton up to 0.9.11-beta. It affects an unknown part of the /app_data file in the Desktop Authentication Middleware component and leads to information disclosure. The attack can be launched remotely, and a public exploit is already available.

A weakness has been identified in Presenton up to 0.9.11-beta in some unknown functionality of the API component, causing missing authentication. The attack can be initiated remotely, and the exploit has been made public. Upgrading to version 0.9.12-beta resolves the issue.

A vulnerability in Presenton before version 0.8.8-beta allows an unauthenticated remote attacker to invoke MCP tools such as generate_presentation by accessing the /mcp path without authentication. This occurs because the nginx front-end does not apply the auth_request gate to that path, and the MCP server auto-mints a valid internal session token for the configured user.