GHSA-9vq7-9h42-j88h

Source

https://github.com/advisories/GHSA-9vq7-9h42-j88h

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-9vq7-9h42-j88h/GHSA-9vq7-9h42-j88h.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-9vq7-9h42-j88h

Aliases

CVE-2025-13822

Published

2026-04-14T12:31:28Z

Modified

2026-04-15T19:49:30.459160Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

MCPHub has an authentication bypass

Details

MCPHub in versions below 0.11.0 is vulnerable to authentication bypass. Some endpoints are not protected by authentication middleware, allowing an unauthenticated attacker to perform actions in the name of other users and using their privileges.

Database specific

{
    "severity": "MODERATE",
    "cwe_ids": [
        "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-15T19:42:53Z",
    "nvd_published_at": "2026-04-14T11:16:24Z"
}

References

Affected packages

npm / @samanhappy/mcphub

Package

Name: @samanhappy/mcphub; View open source insights on deps.dev
Purl: pkg:npm/%40samanhappy/mcphub

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.11.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-9vq7-9h42-j88h/GHSA-9vq7-9h42-j88h.json"