CVE-2026-90474 MCPHub before 1.0.32 OAuth 2.0 Authentication Bypass
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-90474?
CVE-2026-90474 is a high-severity vulnerability in samanhappy mcphub, published on 12 Sep 2026.
Official description
MCPHub before 1.0.32 contains an authentication bypass vulnerability in its embedded OAuth 2.0 authorization server where client authentication is disabled by default and PKCE enforcement is optional. Attackers who obtain an authorization code through interception can redeem it for access tokens without providing a client secret or PKCE verifier, gaining access to victim accounts and their privileges.
Weakness: CWE-287
Which versions are affected by CVE-2026-90474?
How do I fix CVE-2026-90474?
No fix has been published for CVE-2026-90474 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-90474 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-90474 exists.
Sources
Also known as GHSA-3m7m-37xf-xp9x, GHSA-c47m-m826-fc8g.