CoinMeta data: According to Forkast, five different MCP authentication mechanisms were released between mid-September and September 30, without any coordination or interoperability. Behind this phenomenon is the fact that three independent security disclosures made the cost of inaction become negligible. The original specifications of MCP did not include a mandatory authentication framework when they were released in November 2024; authentication was added a year later, by which time thousands of servers had already been deployed without it. Recent disclosures include CVE-2026-59822, a high-severity vulnerability that allowed any forged token holder to generate authenticated MCP sessions.