Security advisories

critical2026-05-14

@samanhappy/mcphub: SSE Endpoint Accepts Arbitrary Username from URL Path Without Authentication, Enabling User Impersonation

GHSA-wf8q-wvv8-p8jf

high2026-04-22

MCPHub has Path Traversal via Malicious MCPB Manifest Name

GHSA-p3h2-2j4p-p83g

medium2026-04-14

MCPHub has an authentication bypass

GHSA-9vq7-9h42-j88h · CVE-2025-13822

medium2025-10-05

MCPHub has an Improper Authorization vulnerability via its handleSseConnection function

GHSA-v7c4-33vf-cqqq · CVE-2025-11287

low2025-10-05

MCPHub's ServerController is vulnerable to Command Injection

GHSA-5q2p-3jg8-2m98 · CVE-2025-11285