CVE-2025-9611 Microsoft Playwright MCP Server < 0.0.40 DNS Rebinding via Missing Origin Header Validation
Attackers can bypass origin checks to invoke MCP tools via DNS rebinding, potentially executing code or bypassing security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-9611?
CVE-2025-9611 is a high-severity missing authorization vulnerability in Microsoft Playwright, published on 7 Jan 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Microsoft Playwright MCP Server versions prior to 0.0.40 fails to validate the Origin header on incoming connections. This allows an attacker to perform a DNS rebinding attack via a victim’s web browser and send unauthorized requests to a locally running MCP server, resulting in unintended invocation of MCP tool endpoints.
Weakness: CWE-749
Which versions are affected by CVE-2025-9611?
2 open source packages ship an affected version, including @playwright/mcp.
| Package | Affected | Fixed in |
|---|---|---|
@playwright/mcp npm | All versions | 0.0.40 |
@playwright/mcp npm | All versions | 0.0.40 |
How do I fix CVE-2025-9611?
Upgrade @playwright/mcp to 0.0.40 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-9611 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-9611 exists.
Sources
Also known as GHSA-6fg3-hvw7-2fwq, GHSA-8rgw-6xp9-2fg3.