@@ -191,7 +191,7 @@ func (p *HTTPProxy) rejectServerRequestToBackend(m *jsonrpc2.Request) {
 }
 
 // routeResponseToWaiter delivers resp to the waiter channel correlated by its
-// composite request ID (compositeKey(sessID, idKey)), if one is registered.
+// composite request ID (the composite key), if one is registered.
 func (p *HTTPProxy) routeResponseToWaiter(resp *jsonrpc2.Response) {
 	if !resp.ID.IsValid() {
 		slog.Warn("received invalid message that is not a valid response",
@@ -200,7 +200,7 @@ func (p *HTTPProxy) routeResponseToWaiter(resp *jsonrpc2.Response) {
 	}
 
 	rawID := resp.ID.Raw()
-	// Composite-only routing: responses must carry composite ID (sessID|idKey)
+	// Composite-only routing: responses must carry the composite key minted by createWaiter
 	sID, ok := rawID.(string)
 	if !ok {
 		slog.Warn("non-string response id (expected composite string); dropping",
 
@@ -33,9 +33,9 @@ func TestDispatchResponses_ResponseRoutesToWaiter(t *testing.T) {
 	t.Parallel()
 	proxy := newDispatcherTestProxy(t)
 
-	waitCh, cleanup := proxy.createWaiter("sess-1", jsonrpc2.StringID("req-1"))
+	waitCh, ck, cleanup, err := proxy.createWaiter("sess-1", jsonrpc2.StringID("req-1"))
+	require.NoError(t, err)
 	defer cleanup()
-	ck := compositeKey("sess-1", idKeyFromID(jsonrpc2.StringID("req-1")))
 
 	resp, err := jsonrpc2.NewResponse(jsonrpc2.StringID(ck), "result", nil)
 	require.NoError(t, err)
@@ -50,6 +50,69 @@ func TestDispatchResponses_ResponseRoutesToWaiter(t *testing.T) {
 	}
 }
 
+// TestDoRequest_SameSessionSameIDDoesNotCrossResponses is the regression test
+// for GHSA-5cgx-5frr-fgv5: a client chooses its own JSON-RPC id, so two
+// in-flight requests in one session may carry the same id. Each must receive
+// the backend response to its own request (never the other's), and each must
+// see its original id restored.
+func TestDoRequest_SameSessionSameIDDoesNotCrossResponses(t *testing.T) {
+	t.Parallel()
+	proxy := newDispatcherTestProxy(t)
+
+	methods := []string{"tools/list", "ping"}
+	type outcome struct {
+		method string
+		msg    jsonrpc2.Message
+		err    error
+	}
+	outcomes := make(chan outcome, len(methods))
+	for _, method := range methods {
+		go func() {
+			ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+			defer cancel()
+			req := &jsonrpc2.Request{ID: jsonrpc2.Int64ID(1), Method: method}
+			msg, err := proxy.doRequest(ctx, "sess-1", req)
+			outcomes <- outcome{method: method, msg: msg, err: err}
+		}()
+	}
+
+	// Fake backend: collect both in-flight requests, then answer them in the
+	// reverse of arrival order, tagging each result with the request's method.
+	var inflight []*jsonrpc2.Request
+	for len(inflight) < len(methods) {
+		select {
+		case msg := <-proxy.messageCh:
+			req, ok := msg.(*jsonrpc2.Request)
+			require.True(t, ok)
+			inflight = append(inflight, req)
+		case <-time.After(2 * time.Second):
+			t.Fatal("timed out waiting for both requests to reach the backend")
+		}
+	}
+	for i := len(inflight) - 1; i >= 0; i-- {
+		resp, err := jsonrpc2.NewResponse(inflight[i].ID, inflight[i].Method, nil)
+		require.NoError(t, err)
+		proxy.responseCh <- resp
+	}
+
+	for range methods {
+		select {
+		case got := <-outcomes:
+			require.NoError(t, got.err, "request %q must not time out or fail", got.method)
+			resp, ok := got.msg.(*jsonrpc2.Response)
+			require.True(t, ok)
+			assert.JSONEq(t, `"`+got.method+`"`, string(resp.Result),
+				"request %q received another request's response", got.method)
+			assert.Equal(t, jsonrpc2.Int64ID(1), resp.ID, "original client id must be restored")
+		case <-time.After(5 * time.Second):
+			t.Fatal("timed out waiting for doRequest to return")
+		}
+	}
+
+	assert.Zero(t, syncMapLen(&proxy.waiters), "waiters must be cleaned up")
+	assert.Zero(t, syncMapLen(&proxy.idRestore), "idRestore must be cleaned up")
+}
+
 // TestDispatchResponses_UnknownCompositeKeyResponseIsDropped verifies a
 // *jsonrpc2.Response whose composite ID has no registered waiter is dropped
 // without blocking or panicking.
 
@@ -89,12 +89,13 @@ type HTTPProxy struct {
 	// Keys are URL path prefixes. Set via WithPrefixHandlers.
 	prefixHandlers map[string]http.Handler
 
-	// Waiters keyed by compositeKey(sessID, idKey) -> one-shot channel for response delivery.
-	// The composite key MUST be unique per concurrent request; sharing it across requests
-	// (e.g. with sessID="" for sessionless requests) silently overwrites entries and crosses
-	// response payloads between unrelated clients. See resolveSessionForRequest.
+	// Waiters keyed by compositeKey(sessID, per-request token) -> one-shot channel for response
+	// delivery. The composite key MUST be unique per concurrent request; sharing it across
+	// requests silently overwrites entries and crosses response payloads between requests.
+	// createWaiter guarantees this by minting the token itself, because neither the session
+	// ID (empty for sessionless requests) nor the client-chosen JSON-RPC ID is unique.
 	waiters sync.Map // map[string]chan jsonrpc2.Message
-	// Keyed by the same compositeKey(sessID, idKey); stores the original client JSON-RPC ID
+	// Keyed by the same composite key; stores the original client JSON-RPC ID
 	// to restore before replying. Same uniqueness requirement as `waiters`.
 	idRestore sync.Map // map[string]jsonrpc2.ID
 
@@ -1026,10 +1027,10 @@ func (p *HTTPProxy) restoreResponseID(resp *jsonrpc2.Response, ck string) (jsonr
 func (p *HTTPProxy) sendCorrelatedRequest(
 	sessID string, req *jsonrpc2.Request,
 ) (waitCh chan jsonrpc2.Message, ck string, cleanup func(), err error) {
-	key := idKeyFromID(req.ID)
-	ck = compositeKey(sessID, key)
-
-	waitCh, cleanup = p.createWaiter(sessID, req.ID)
+	waitCh, ck, cleanup, err = p.createWaiter(sessID, req.ID)
+	if err != nil {
+		return nil, "", nil, err
+	}
 
 	proxiedMsg, err := encodeRequestWithID(req, ck)
 	if err != nil {
@@ -1099,11 +1100,12 @@ func (p *HTTPProxy) ensureSession(r *http.Request, id string) error {
 // in-process routing token (not registered with sessionManager). Sessionless
 // routing tokens MUST be unique per request: sharing one (e.g. the empty string,
 // or a stale/foreign Mcp-Session-Id) across concurrent sessionless requests with
-// the same JSON-RPC id collapses them onto the same compositeKey(sessID, idKey)
-// and overwrites entries in the waiters / idRestore sync.Maps, leaking one
+// the same JSON-RPC id could otherwise share routing state and leak one
 // client's response payload to another. This is a confidentiality bug, not a
 // performance issue -- do not collapse the token, and do not let a Modern
-// request fall through to the session-lookup path below.
+// request fall through to the session-lookup path below. (The waiter key
+// itself is additionally made unique per request by createWaiter, so two
+// requests in one session reusing an id are isolated too.)
 //
 // Writes HTTP errors on failure and returns error to stop handling.
 func (p *HTTPProxy) resolveSessionForRequest(
@@ -1652,10 +1654,21 @@ func resolveRequestTimeout() time.Duration {
 	return defaultRequestTimeout
 }
 
-// createWaiter registers a waiter channel for the given request ID and returns cleanup fn.
-func (p *HTTPProxy) createWaiter(sessID string, id jsonrpc2.ID) (chan jsonrpc2.Message, func()) {
-	key := idKeyFromID(id)
-	ck := compositeKey(sessID, key)
+// createWaiter registers a waiter channel for a request and returns the channel,
+// the composite key (ck) the request must carry upstream, and a cleanup fn.
+//
+// ck is minted here from a per-request random token, never from the
+// client-chosen JSON-RPC id: a client may have several requests with the same id
+// in flight in one session, and a key derived from the id would let them
+// overwrite each other's waiter and receive each other's responses (including
+// responses the authz response filter never saw). The client's original id is
+// kept in idRestore and put back on the reply.
+func (p *HTTPProxy) createWaiter(sessID string, id jsonrpc2.ID) (chan jsonrpc2.Message, string, func(), error) {
+	token, err := uuid.NewRandom()
+	if err != nil {
+		return nil, "", nil, fmt.Errorf("generate request correlation token: %w", err)
+	}
+	ck := compositeKey(sessID, token.String())
 	// store original client id to restore before replying
 	p.idRestore.Store(ck, id)
 
@@ -1666,5 +1679,5 @@ func (p *HTTPProxy) createWaiter(sessID string, id jsonrpc2.ID) (chan jsonrpc2.M
 		p.waiters.Delete(ck)
 		p.idRestore.Delete(ck)
 	}
-	return ch, cleanup
+	return ch, ck, cleanup, nil
 }
@@ -135,28 +135,11 @@ func writeJSONRPC(w http.ResponseWriter, msg jsonrpc2.Message) error {
 	return err
 }
 
-// idKeyFromID returns a stable string key for a jsonrpc2.ID using its raw value.
-// We prefix with type to avoid collisions between numeric and string IDs.
-func idKeyFromID(id jsonrpc2.ID) string {
-	raw := id.Raw()
-	switch v := raw.(type) {
-	case string:
-		return "s:" + v
-	case float64:
-		// JSON numbers decode to float64
-		return fmt.Sprintf("n:%v", v)
-	case json.Number:
-		return "n:" + v.String()
-	case nil:
-		return "nil"
-	default:
-		return fmt.Sprintf("%T:%v", v, v)
-	}
-}
-
-// compositeKey builds a stable composite key from session ID and request ID key.
-func compositeKey(sessID, idKey string) string {
-	return sessID + "|" + idKey
+// compositeKey builds the upstream correlation key from the session ID and a
+// per-request token. The token must be unique per in-flight request (see
+// createWaiter); it must never be derived from the client-chosen JSON-RPC id.
+func compositeKey(sessID, requestToken string) string {
+	return sessID + "|" + requestToken
 }
 
 // extractStringParam returns params[key] as a string, and whether it was