CVE-2026-90474: Improper Authentication in samanhappy mcphub
MCPHub versions before 1.0.32 have an authentication bypass vulnerability in their embedded OAuth 2.0 authorization server. The vulnerability arises because client authentication is disabled by default and PKCE enforcement is optional. An attacker who intercepts an authorization code can redeem it for access tokens without needing a client secret or PKCE verifier, potentially gaining unauthorized access to victim accounts and their privileges.
AI Analysis
Technical Summary
CVE-2026-90474 describes an authentication bypass vulnerability in samanhappy's MCPHub product prior to version 1.0.32. The embedded OAuth 2.0 authorization server disables client authentication by default and makes PKCE enforcement optional. This misconfiguration allows attackers who intercept an authorization code to redeem it for access tokens without providing a client secret or PKCE verifier, thereby bypassing authentication controls and accessing victim accounts with their privileges.
Potential Impact
Successful exploitation allows attackers to bypass OAuth 2.0 client authentication and PKCE protections, enabling them to redeem intercepted authorization codes for access tokens. This grants unauthorized access to victim accounts and their associated privileges, potentially leading to account compromise and unauthorized actions within MCPHub.
Mitigation Recommendations
A fixed version is available: upgrade MCPHub to version 1.0.32 or later to address this vulnerability. Until then, ensure client authentication and PKCE enforcement are enabled in the OAuth 2.0 authorization server configuration to mitigate the risk.
CVE-2026-90474: Improper Authentication in samanhappy mcphub
Description
MCPHub versions before 1.0.32 have an authentication bypass vulnerability in their embedded OAuth 2.0 authorization server. The vulnerability arises because client authentication is disabled by default and PKCE enforcement is optional. An attacker who intercepts an authorization code can redeem it for access tokens without needing a client secret or PKCE verifier, potentially gaining unauthorized access to victim accounts and their privileges.
CVSS v4.0
Score 7.6high
Affected software
samanhappy
mcphub
pkg:github/samanhappy/mcphubRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-90474 describes an authentication bypass vulnerability in samanhappy's MCPHub product prior to version 1.0.32. The embedded OAuth 2.0 authorization server disables client authentication by default and makes PKCE enforcement optional. This misconfiguration allows attackers who intercept an authorization code to redeem it for access tokens without providing a client secret or PKCE verifier, thereby bypassing authentication controls and accessing victim accounts with their privileges.
Potential Impact
Successful exploitation allows attackers to bypass OAuth 2.0 client authentication and PKCE protections, enabling them to redeem intercepted authorization codes for access tokens. This grants unauthorized access to victim accounts and their associated privileges, potentially leading to account compromise and unauthorized actions within MCPHub.
Mitigation Recommendations
A fixed version is available: upgrade MCPHub to version 1.0.32 or later to address this vulnerability. Until then, ensure client authentication and PKCE enforcement are enabled in the OAuth 2.0 authorization server configuration to mitigate the risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-12T02:03:32.649Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aa534db55bf5e2cf5350309
Added to database: 09/12/2026, 11:17:47 UTC
Last enriched: 09/12/2026, 11:31:27 UTC
Last updated: 09/12/2026, 13:38:54 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.