A vulnerability has been discovered in ChatGPTNextWeb NextChat versions up to 2.16.1. The issue affects the addMcpServer function in app/mcp/actions.ts file, leading to improper authorization. The vulnerability allows for remote exploitation and the exploit has been publicly disclosed. The project maintainers were notified through an issue report but have not responded yet. This creates a significant security risk as the exploit is now available for malicious use.