GitHub Advisoryadvisory · npm

GHSA-9vq7-9h42-j88h MCPHub has an authentication bypass

MEDIUM Published 2026-04-14 Modified 2026-04-15 Official page ↗
Aliases
CVE-2025-13822
Ecosystem
npm
Packages
@samanhappy/mcphub
Severity
Moderate
CVSS vector
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-639
Reviewed
2026-04-15

Affected packages

• npm @samanhappy/mcphub: < 0.11.0 → fixed in 0.11.0

Description

MCPHub in versions below 0.11.0 is vulnerable to authentication bypass. Some endpoints are not protected by authentication middleware, allowing an unauthenticated attacker to perform actions in the name of other users and using their privileges.

Related

Alias · CVE (1)

  • CVE-2025-13822 MCPHub in versions below 0.11.0 is vulnerable to authentication bypass. vulnerability

Weakness · CWE (1)

  • CWE-639 Authorization Bypass Through User-Controlled Key weakness

References