Executive brief
MCPHub is a middleware service that routes API calls through Server-Sent Events (SSE) channels. An unauthenticated attacker can impersonate any user—including administrators—by supplying an arbitrary username in the URL path, gaining access to user-scoped resources, executing commands under spoofed identities, and corrupting audit logs. This affects all deployments where bearer authentication is not explicitly configured.
Technical details
The sseUserContextMiddleware in src/middlewares/userContext.ts accepts a username directly from the URL path parameter (req.params.user) without any authentication check, database validation, or token verification, constructing a fabricated IUser object that is accepted as legitimate. The SSE routes in src/server.ts apply only rate limiting and this vulnerable middleware—no authentication middleware protects the endpoints. Additionally, UserContextService is a singleton that stores the current user in a single instance variable, creating a race condition (CWE-362) where concurrent connections can overwrite each other's context. An attacker with network access to the SSE endpoint can connect as any user and execute MCP tool calls under the spoofed identity. The vulnerability was fixed in version 0.12.17.
Affected products
- samanhappy mcphub <0.12.17
Timeline
- 2026-05-14: disclosed
- 2026-05-14: patched: Fixed in version 0.12.17