---
id: CVE-2026-90474
title: >-
  MCPHub before 1.0.32 contains an authentication bypass vulnerability in its
  embedded OAuth 2.0 authorization server where client authentication is
  disabled by default and PKCE enforcement is optional
summary: >-
  MCPHub before 1.0.32 contains an authentication bypass vulnerability in its
  embedded OAuth 2.0 authorization server where client authentication is
  disabled by default and PKCE enforcement is optional. Attackers who obtain an
  authorizatio…
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N'
cwe:
  - CWE-287
vendor: samanhappy
product: mcphub
affected:
  - mcphub < 1.0.32
published: '2026-09-12'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T17:17:47.390'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90474'
references:
  - url: >-
      https://github.com/samanhappy/mcphub/blob/v1.0.31/src/services/oauthServerService.ts#L26-L38
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/samanhappy/mcphub/commit/e927620cd1a80e8691213b01eb8cd6ffa1a66e9f
    label: disclosure@vulncheck.com
  - url: 'https://github.com/samanhappy/mcphub/releases/tag/v1.0.32'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/samanhappy/mcphub/security/advisories/GHSA-3m7m-37xf-xp9x
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/mcphub-before-1.0.32-oauth-2.0-authentication-bypass
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/samanhappy/mcphub/security/advisories/GHSA-3m7m-37xf-xp9x
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.003
epssPercentile: 0.22925
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-15T16:57:39.875184Z'
ingestedAt: '2026-09-14T15:23:07.480Z'
---

## Overview

MCPHub before 1.0.32 contains an authentication bypass vulnerability in its embedded OAuth 2.0 authorization server where client authentication is disabled by default and PKCE enforcement is optional. Attackers who obtain an authorization code through interception can redeem it for access tokens without providing a client secret or PKCE verifier, gaining access to victim accounts and their privileges.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.