CVE-2026-90474
mediumMCPHub before 1.0.32 contains an authentication bypass vulnerability in its embedded OAuth 2.0 authorization server where client authentication is disabled by…
MCPHub before 1.0.32 contains an authentication bypass vulnerability in its embedded OAuth 2.0 authorization server where client authentication is disabled by default and PKCE enforcement is optional. Attackers who obtain an authorization code through interception can redeem it for access tokens without providing a client secret or PKCE verifier, gaining access to victim accounts and their privileges.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/samanhappy/mcphub/blob/v1.0.31/src/services/oauthServerService.ts#L26-L... disclosure@vulncheck.com
- https://github.com/samanhappy/mcphub/commit/e927620cd1a80e8691213b01eb8cd6ffa1a66e9f disclosure@vulncheck.com
- https://github.com/samanhappy/mcphub/releases/tag/v1.0.32 disclosure@vulncheck.com
- https://github.com/samanhappy/mcphub/security/advisories/GHSA-3m7m-37xf-xp9x disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/mcphub-before-1.0.32-oauth-2.0-authentication-bypass disclosure@vulncheck.com
- https://github.com/samanhappy/mcphub/security/advisories/GHSA-3m7m-37xf-xp9x 134c704f-9b21-4f2e-91b3-4a467353bcc0