mcphub vulnerabilities
CVEs whose affected-version data names the mcphub package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
6 CVEsRSS
CVE-2026-94047Medium· 6.3PoCA security vulnerability has been detected in samanhappy MCPHub up to 1.0.32
A security vulnerability has been detected in samanhappy MCPHub up to 1.0.32. The impacted element is the function importTemplate of the file src/services/templateService.ts of the component Template Import Endpoint. The manipulation lea…
CVE-2026-90474Medium· 6.8PoCMCPHub before 1.0.32 contains an authentication bypass vulnerability in its embedded OAuth 2.0 authorization server where client authentication is disabled by default and PKCE enforcement is optional
MCPHub before 1.0.32 contains an authentication bypass vulnerability in its embedded OAuth 2.0 authorization server where client authentication is disabled by default and PKCE enforcement is optional. Attackers who obtain an authorizatio…
CVE-2025-13822Medium· 5.3MCPHub in versions below 0.11.0 is vulnerable to authentication bypass
MCPHub in versions below 0.11.0 is vulnerable to authentication bypass. Some endpoints are not protected by authentication middleware, allowing an unauthenticated attacker to perform actions in the name of other users and using their pri…
CVE-2025-11287High· 7.3A vulnerability was identified in samanhappy MCPHub up to 0.9.10
A vulnerability was identified in samanhappy MCPHub up to 0.9.10. This vulnerability affects the function handleSseConnectionfunction of the file src/services/sseService.ts. Such manipulation leads to improper authentication. The attack …
CVE-2025-11286Medium· 4.7A vulnerability was determined in samanhappy MCPHub up to 0.9.10
A vulnerability was determined in samanhappy MCPHub up to 0.9.10. This affects an unknown part of the file src/controllers/serverController.ts of the component MCPRouter Service. This manipulation of the argument baseUrl causes server-si…
CVE-2025-11285Medium· 6.3A vulnerability was found in samanhappy MCPHub up to 0.9.10
A vulnerability was found in samanhappy MCPHub up to 0.9.10. Affected by this issue is some unknown functionality of the file src/controllers/serverController.ts. The manipulation of the argument command/args results in os command inject…