Executive brief
MCPHub is an open-source Node.js library used for managing protocol connections. The vulnerability allows attackers to bypass authentication checks in the Server-Sent Events (SSE) connection handler, potentially granting unauthorized access to protected functionality. An attacker could exploit this remotely without authentication to compromise data integrity or availability.
Technical details
A improper authorization vulnerability (CWE-287) exists in the handleSseConnection function of src/services/sseService.ts in MCPHub up to version 0.9.10. The vulnerability stems from inadequate authentication validation when establishing SSE connections, allowing unauthenticated attackers to bypass security controls. The attack is remotely exploitable over the network and requires no special preconditions or user interaction. An attacker can leverage this to gain unauthorized access to SSE functionality. A patch has not been released as the vendor did not respond to the disclosure, though the exploit code is publicly available.
Affected products
- samanhappy MCPHub up to 0.9.10
Timeline
- 2025-10-05: disclosed: Published in GitHub Advisory Database
- 2025-09-23: other: CVE-2025-11287 issue opened