MCPHub has an authentication bypass

Description

MCPHub in versions below 0.11.0 is vulnerable to authentication bypass. Some endpoints are not protected by authentication middleware, allowing an unauthenticated attacker to perform actions in the name of other users and using their privileges.

Recommendation

Update the @samanhappy/mcphub package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.11.0
• Patched version(s): 0.11.0

References

• GHSA-9vq7-9h42-j88h
• cert.pl
• CVE-2025-13822
• CWE-639
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• MCPHub has an Improper Authorization vulnerability via its handleSseConnection function - CVE-2025-11287
• FUXA has JWT Authentication Bypass via HTTP Referer header spoofing - CVE-2025-69985
• Authentication Bypass via Default JWT Secret in NocoBase docker-compose Deployments - CVE-2025-13877
• validator.js has a URL validation bypass vulnerability in its isURL function - CVE-2025-56200

You might also like:

How do hackers hack websites?

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@samanhappy/mcphub