CVE-2026-90474CWE-287

CVE-2026-90474

Medium · published September 12, 2026

CVSS v3.1
6.8
EPSS
1%
Percentile
45.5
In the wild
Unconfirmed
What it is

MCPHub before 1.0.32 contains an authentication bypass vulnerability in its embedded OAuth 2.0 authorization server where client authentication is disabled by default and PKCE enforcement is optional. Attackers who obtain an authorization code through interception can redeem it for access tokens without providing a client secret or PKCE verifier, gaining access to victim accounts and their privileges.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
7.6 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00553 · 45.5th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-09-12T15:16Z
References (6)
https://github.com/samanhappy/mcphub/blob/v1.0.31/src/services/oauthServerService.ts#L26-L38 · [email protected]https://github.com/samanhappy/mcphub/commit/e927620cd1a80e8691213b01eb8cd6ffa1a66e9f · [email protected]https://github.com/samanhappy/mcphub/releases/tag/v1.0.32 · [email protected]https://github.com/samanhappy/mcphub/security/advisories/GHSA-3m7m-37xf-xp9x · [email protected]https://www.vulncheck.com/advisories/mcphub-before-1.0.32-oauth-2.0-authentication-bypass · [email protected]https://github.com/samanhappy/mcphub/security/advisories/GHSA-3m7m-37xf-xp9x · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 14 SEP 03:24Z
    EPSS moved — → 0%
    epss
  • 12 SEP 11:06Z
    MCPHub before 1.0.32 OAuth 2.0 Authentication Bypass
    cvelistv5