CVE-2026-90474: MCPHub before 1.0.32 OAuth 2.0 Authentication Bypass
MCPHub before 1.0.32 contains an authentication bypass vulnerability in its embedded OAuth 2.0 authorization server where client authentication is disabled by default and PKCE enforcement is optional. Attackers who obtain an authorization code through interception can redeem it for access tokens without providing a client secret or PKCE verifier, gaining access to victim accounts and their privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MCPHubto a version that resolves this vulnerability.Fixed in 1.0.32 - Configuration
Ensure client authentication is enabled (it is disabled by default in MCPHub versions before 1.0.32) so that client secrets are required for token redemption.
MCPHub embedded OAuth 2.0 authorization server client authentication = enabled - Configuration
Enable/require PKCE enforcement (PKCE is optional in MCPHub versions before 1.0.32) to prevent redemption of an intercepted authorization code without the PKCE verifier.
MCPHub embedded OAuth 2.0 authorization server PKCE enforcement = required
Event History
Frequently Asked Questions
Which deployments are exposed by default?
MCPHub versions before 1.0.32 are affected because embedded OAuth 2.0 client authentication is disabled by default and PKCE enforcement is optional.
What does an attacker need to exploit this issue?
An attacker must obtain an OAuth authorization code through interception. They can then redeem that code for an access token without a client secret or PKCE verifier.
What access can a successful attacker obtain?
A successful attacker can gain access to the victim account and the privileges associated with that account.