Medium severity · published Sep 12, 2026
CVE-2026-90474
MCPHub before 1.0.32 OAuth 2.0 Authentication Bypass
6.8
CVSS
0.6%
EPSS
No
On KEV
Description
MCPHub before 1.0.32 contains an authentication bypass vulnerability in its embedded OAuth 2.0 authorization server where client authentication is disabled by default and PKCE enforcement is optional. Attackers who obtain an authorization code through interception can redeem it for access tokens without providing a client secret or PKCE verifier, gaining access to victim accounts and their privileges.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MC
mcphub · samanhappy
before 1.0.32 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-90474
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-90474
github.com
https://github.com/samanhappy/mcphub/blob/v1.0.31/src/services/oauthServerService.ts#L26-L38
github.com
https://github.com/samanhappy/mcphub/commit/e927620cd1a80e8691213b01eb8cd6ffa1a66e9f
github.com
https://github.com/samanhappy/mcphub/releases/tag/v1.0.32
github.com
https://github.com/samanhappy/mcphub/security/advisories/GHSA-3m7m-37xf-xp9x
www.vulncheck.com
https://www.vulncheck.com/advisories/mcphub-before-1.0.32-oauth-2.0-authentication-bypass
More from mcphub
9.9
CVE-2026-79748
MCPHub: Authenticated non-admin user achieves RCE via POST /api/servers (missing authorization on stdio command/args)
9.8
CVE-2025-11287
samanhappy MCPHub sseService.ts handleSseConnectionfunction improper authentication
8.8
CVE-2026-79744
MCPHub: Missing Authorization on `PUT /api/system-config` Lets Any Non-Admin Rewrite Global Security Configuration
8.8
CVE-2025-11285
samanhappy MCPHub serverController.ts os command injection
8.1
CVE-2026-79746
MCPHub: Server-scoped bearer key gains access to an entire group via partial (any-overlap) server matching