Vulnerability Description
MCPHub before 1.0.32 contains an authentication bypass vulnerability in its embedded OAuth 2.0 authorization server where client authentication is disabled by default and PKCE enforcement is optional. Attackers who obtain an authorization code through interception can redeem it for access tokens without providing a client secret or PKCE verifier, gaining access to victim accounts and their privileges.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/samanhappy/mcphub/blob/v1.0.31/src/services/oauthServerServic
- https://github.com/samanhappy/mcphub/commit/e927620cd1a80e8691213b01eb8cd6ffa1a6
- https://github.com/samanhappy/mcphub/releases/tag/v1.0.32
- https://github.com/samanhappy/mcphub/security/advisories/GHSA-3m7m-37xf-xp9x
- https://www.vulncheck.com/advisories/mcphub-before-1.0.32-oauth-2.0-authenticati
- https://github.com/samanhappy/mcphub/security/advisories/GHSA-3m7m-37xf-xp9x
FAQ
What is CVE-2026-90474?
CVE-2026-90474 is a vulnerability with a CVSS score of 6.8 (MEDIUM). MCPHub before 1.0.32 contains an authentication bypass vulnerability in its embedded OAuth 2.0 authorization server where client authentication is disabled by default and PKCE enforcement is optional....
How severe is CVE-2026-90474?
CVE-2026-90474 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-90474?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.