MCPHub Auth Bypass Flaw Disclosed

MCPHub versions below 0.11.0 lack authentication on some endpoints, letting unauthenticated attackers act with other users' privileges.

CERT Polska coordinated the disclosure of CVE-2025-13822, an authentication bypass vulnerability affecting the MCPHub project in versions prior to 0.11.0. The flaw stems from certain endpoints not being protected by authentication middleware, which allows an unauthenticated attacker to perform actions on behalf of other users, effectively assuming their privileges.

The vulnerability was reported to CERT Polska by researcher Eryk Winiarz through the organization's coordinated vulnerability disclosure (CVD) process. No evidence of active exploitation is mentioned in the advisory, and the primary recommendation is for affected organizations to upgrade to MCPHub 0.11.0 or later.

Source reporting: https://cert.pl/en/posts/2026/04/CVE-2025-13822