MCPHub OAuth 2.0 authentication bypass vulnerability

MCPHub before version 1.0.32 contains an authentication bypass vulnerability in its embedded OAuth 2.0 authorization server where client authentication is disabled by default and PKCE enforcement is optional, allowing attackers to redeem intercepted authorization codes for access tokens without proper credentials.

Disclosed 12 September 2026 · Record updated 1 October 2026

Impact

Attackers who obtain an authorization code through interception can redeem it for access tokens without providing a client secret or PKCE verifier, gaining access to victim accounts and their privileges.

Our coverage

A thief plucks a glowing token from midair, inserts it into a locked door, and walks straight through as the rightful owner.

Vulnerabilities

MCPHub OAuth flaw lets attackers swap codes for tokens

A vulnerability disclosed on 12 September 2026 lets anyone holding an intercepted authorization code take over MCPHub accounts without a client secret.

14 Sept 2026

Sources

nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2026-90474