MCPHub has an Improper Authorization vulnerability via its handleSseConnection function

Description

A vulnerability was identified in samanhappy MCPHub up to 0.9.10. This vulnerability affects the function handleSseConnection of the file src/services/sseService.ts. Such manipulation leads to improper authentication. The attack may be launched remotely. The exploit is publicly available and might be used.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 0.9.10

References

• GHSA-v7c4-33vf-cqqq
• vuldb.com
• CVE-2025-11287
• CWE-287
• CAPEC-310
• OWASP 2021-A6
• OWASP 2021-A7

Related Issues

• validator.js has a URL validation bypass vulnerability in its isURL function - CVE-2025-56200
• MCPHub has an authentication bypass - CVE-2025-13822
• RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests - CVE-2026-39371
• MCPHub has Path Traversal via Malicious MCPB Manifest Name - Vulnerability

You might also like:

Exploiting Server Version Disclosure

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Tags:

npm

@samanhappy/mcphub