---
id: CVE-2025-13822
title: "MCPHub in versions below\_0.11.0 is vulnerable to authentication bypass"
summary: "MCPHub in versions below\_0.11.0 is vulnerable to authentication bypass. Some endpoints are not protected by authentication middleware, allowing an unauthenticated attacker to perform actions in the name of other users and using their pri…"
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-639
vendor: mcphubx
product: mcphub
affected:
  - mcphub < 0.11.0
patched:
  - mcphub 0.11.0
published: '2026-04-14'
updated: '2026-09-03'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-13822'
references:
  - url: 'https://cert.pl/en/posts/2026/04/CVE-2025-13822'
    label: cvd@cert.pl
  - url: 'https://github.com/samanhappy/mcphub'
    label: cvd@cert.pl
tags:
  - nvd
epss: 0.00353
epssPercentile: 0.26264
ingestedAt: '2026-09-03T03:55:24.558Z'
---

## Overview

MCPHub in versions below 0.11.0 is vulnerable to authentication bypass. Some endpoints are not protected by authentication middleware, allowing an unauthenticated attacker to perform actions in the name of other users and using their privileges.

## Affected

- `mcphub < 0.11.0`

## Remediation

Upgrade past the affected range:

- `mcphub 0.11.0`