Skip to content
Threat Feed

Product

@Samanhappy/Mcphub (< 0.12.15)

1 brief RSS
critical advisory

MCPHub User Impersonation Vulnerability via Unauthenticated SSE Endpoint

MCPHub is vulnerable to user identity spoofing on the MCP transport layer; an unauthenticated network user can impersonate any user, including administrators, on SSE/MCP endpoints by providing the target username in the URL path, which allows execution of MCP tool calls under a spoofed user's identity, access to user-scoped resources and data, and poisoning of audit logs.

@samanhappy/mcphub identity-spoofing sse mcp unauthenticated-access
2r 3t