When the model supplies the parameter: CVE-2026-54547 and CVE-2026-54549 in the Meta Ads MCP server

One Meta Ads MCP advisory covers a URL parameter the server fetches with redirects followed and no validation, and the other covers middleware that reads the wrong token header.