Authentication Bypass in MCPHub OAuth 2.0 Server

Executive Summary

CVE-2026-90474 is an authentication bypass in MCPHub before version 1.0.32. The vulnerability exists in its embedded OAuth 2.0 authorization server where client authentication is disabled by default and PKCE enforcement is optional. Attackers can intercept authorization codes and redeem them for access tokens without providing a client secret or PKCE verifier, gaining unauthorized access to victim accounts and their privileges.

Useful 0 Not Useful 0

Detection Guidance

Check if MCPHub is running versions before 1.0.32 using package managers like npm or by inspecting version files. Monitor OAuth authorization logs for missing client secret or PKCE verifier during token requests. Look for unusual authorization code redemption without proper validation.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to gain unauthorized access to user accounts and their privileges by exploiting weak OAuth 2.0 authentication. If you use MCPHub versions before 1.0.32, attackers could intercept authorization codes and redeem them for access tokens without proper verification, potentially leading to data breaches or unauthorized actions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. Non-compliance may result in legal penalties, reputational damage, and loss of trust due to potential data breaches and unauthorized access to protected health information or personal data.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade MCPHub to version 1.0.32 or later immediately. Enforce PKCE for all public clients and require client secrets for confidential clients. Secure dynamic client registration with authentication and rate limiting.

Useful 0 Not Useful 0