GHSA-wf8q-wvv8-p8jf
Critical · 9.1CVSS
9.1
EPSS
—
Published
May 14, 2026
CISA due date
—
The record
@samanhappy/mcphub: SSE Endpoint Accepts Arbitrary Username from URL Path Without Authentication, Enabling User Impersonation
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @samanhappy/mcphub | 0 | 0.12.15 |
Related vulnerabilities
- GHSA-p3h2-2j4p-p83g MCPHub has Path Traversal via Malicious MCPB Manifest Name Also affects @samanhappy/mcphub
- GHSA-9vq7-9h42-j88h MCPHub has an authentication bypass Also affects @samanhappy/mcphub
- CVE-2025-13822 MCPHub in versions below 0.11.0 is vulnerable to authentication bypass. Also affects @samanhappy/mcphub
- CVE-2026-114640 Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its… CWE-290
- CVE-2026-90711 proxy-addr is a Node.js module that determines a request's client address behind trusted… CWE-290
- CVE-2026-66674 Unauthenticated Bypass Vulnerability in Simple Cloudflare Turnstile <= 1.42.1 versions. CWE-290
- CVE-2026-82563 An attacker could impersonate the camera and place themselves in a man-in-the-middle or… CWE-290
- CVE-2026-82530 IP2Location Country Blocker plugin for WordPress before 2.45.0 contains an access control… CWE-290