What is GHSA-9vq7-9h42-j88h?

GHSA-9vq7-9h42-j88h is a security advisory published by GitHub Security Advisories with Medium severity. MCPHub has an authentication bypass

Which CVE IDs does GHSA-9vq7-9h42-j88h cover?

GHSA-9vq7-9h42-j88h covers the following CVE IDs: CVE-2025-13822. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-9vq7-9h42-j88h?

GHSA-9vq7-9h42-j88h affects 1 product, including: npm/@samanhappy/mcphub:\u003c 0.11.0.

GHSA-9vq7-9h42-j88hMedium

MCPHub has an authentication bypass

Vendor

GitHub Security Advisories

Published

April 14, 2026

Last Modified

April 15, 2026

🔗 CVE IDs covered (1)

CVE-2025-13822 →

📋 Description

MCPHub in versions below 0.11.0 is vulnerable to authentication bypass. Some endpoints are not protected by authentication middleware, allowing an unauthenticated attacker to perform actions in the name of other users and using their privileges.

🎯 Affected products1

npm/@samanhappy/mcphub:< 0.11.0

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2025-13822
https://cert.pl/en/posts/2026/04/CVE-2025-13822
https://github.com/samanhappy/mcphub
https://github.com/advisories/GHSA-9vq7-9h42-j88h