CVE-2025-13822
Medium · 5.3CVSS
5.3
EPSS
0.4%
Published
Apr 14, 2026
CISA due date
—
The record
MCPHub in versions below 0.11.0 is vulnerable to authentication bypass. Some endpoints are not protected by authentication middleware, allowing an unauthenticated attacker to perform actions in the name of other users and using their privileges.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @samanhappy/mcphub | 0 | 0.11.0 |
Related vulnerabilities
- GHSA-9vq7-9h42-j88h MCPHub has an authentication bypass Same vulnerability
- GHSA-wf8q-wvv8-p8jf @samanhappy/mcphub: SSE Endpoint Accepts Arbitrary Username from URL Path Without… Also affects @samanhappy/mcphub
- GHSA-p3h2-2j4p-p83g MCPHub has Path Traversal via Malicious MCPB Manifest Name Also affects @samanhappy/mcphub
- CVE-2026-13319 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before… CWE-639
- CVE-2026-111767 MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and… CWE-639
- CVE-2026-105755 vLLM is an inference and serving engine for large language models. CWE-639
- CVE-2026-105754 vLLM is an inference and serving engine for large language models. CWE-639
- CVE-2026-62140 Unauthenticated Insecure Direct Object References (IDOR) in Quiz And Survey Master <=… CWE-639