PT-2026-32617 · Mcphub · Mcphub

Eryk Winiarz · CVE-2025-13822 · Published 2026-04-14 · Updated 2026-05-01

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions MCPHub versions prior to 0.11.0

Description An authentication bypass exists because some endpoints are not protected by authentication middleware. This allows an unauthenticated attacker to perform actions on behalf of other users using their privileges.

Recommendations Update to version 0.11.0 or later.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-13822

GHSA-9VQ7-9H42-J88H

Affected Products

Mcphub

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/13xxx/CVE-2025-13822.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-13822 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9vq7-9h42-j88h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-13822 · Security Note
• https://github.com/samanhappy/mcphub · Note
• https://npmjs.com/package/@samanhappy/mcphub · Note
• https://cert.pl/en/posts/2026/04/CVE-2025-13822 · Note
• https://twitter.com/CVEnew/status/2045972388760985910 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2044031663227785273 · Twitter Post
• https://t.me/cveNotify/161757 · Telegram Post
• https://twitter.com/vuldb/status/2044350557390008421 · Twitter Post