PT-2026-32617 · Mcphub · Mcphub

Eryk Winiarz · Published 2026-04-14 · Updated 2026-05-01 · CVE-2025-13822

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions MCPHub versions prior to 0.11.0

Description An authentication bypass exists because some endpoints are not protected by authentication middleware. This allows an unauthenticated attacker to perform actions on behalf of other users using their privileges.

Recommendations Update to version 0.11.0 or later.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-13822

GHSA-9VQ7-9H42-J88H

Affected Products

Mcphub

References · 8

• https://osv.dev/vulnerability/GHSA-9vq7-9h42-j88h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-13822 · Security Note
• https://github.com/samanhappy/mcphub · Note
• https://t.me/cveNotify/161757 · Telegram Post
• https://cert.pl/en/posts/2026/04/CVE-2025-13822 · Note
• https://twitter.com/CVEnew/status/2045972388760985910 · Twitter Post
• https://twitter.com/vuldb/status/2044350557390008421 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2044031663227785273 · Twitter Post