CVE-2025-13822CWE-639

CVE-2025-13822

Medium · published April 14, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
27.8
In the wild
Unconfirmed
What it is

MCPHub in versions below 0.11.0 is vulnerable to authentication bypass. Some endpoints are not protected by authentication middleware, allowing an unauthenticated attacker to perform actions in the name of other users and using their privileges.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00353 · 27.8th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-04-14T15:16Z
Affected products (1)
ProductVersionsFixed in
mcphubx/mcphub< 0.11.00.11.0
References (2)
https://cert.pl/en/posts/2026/04/CVE-2025-13822 · [email protected]https://github.com/samanhappy/mcphub · [email protected]
EPSS history
Timeline
  • 14 APR 10:23Z
    Authentication bypass in MCPHub
    cvelistv5