Vulnerability · Published Sep 12, 2026 · Assigned by VulnCheck

CVE-2026-90474MCPHub before 1.0.32 OAuth 2.0 Authentication Bypass

Medium 6.8

In plain English

A medium-severity improper authentication in mcphub from samanhappy. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)0.6%top 53.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

MCPHub before 1.0.32 contains an authentication bypass vulnerability in its embedded OAuth 2.0 authorization server where client authentication is disabled by default and PKCE enforcement is optional. Attackers who obtain an authorization code through interception can redeem it for access tokens without providing a client secret or PKCE verifier, gaining access to victim accounts and their privileges.

Affected products (as reported)

Vendor	Product	Versions
samanhappy	mcphub	0 – before 1.0.32

Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

References

GitHub Security Advisory (GHSA-3m7m-37xf-xp9x) third-party-advisory, vendor-advisory
fix(security): enforce OAuth client auth and S256-only PKCE policy patch
getClient() verifies a registered secret only when one is supplied, at v1.0.31 technical-description
mcphub v1.0.32 Release Notes release-notes
VulnCheck Advisory: MCPHub before 1.0.32 OAuth 2.0 Authentication Bypass third-party-advisory