CVE-2025-11287
published 2025-10-05CVE-2025-11287: A vulnerability was identified in samanhappy MCPHub up to 0.9.10. This vulnerability affects the function handleSseConnectionfunction of the file…
PriorityP264critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.58%
43.5th percentile
A vulnerability was identified in samanhappy MCPHub up to 0.9.10. This vulnerability affects the function handleSseConnectionfunction of the file src/services/sseService.ts. Such manipulation leads to improper authentication. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mcphubx | mcphub | <= 0.9.10 | — |
| samanhappy | mcphub | — | — |
| samanhappy | mcphub | — | — |
| samanhappy | mcphub | — | — |
| samanhappy | mcphub | — | — |
| samanhappy | mcphub | — | — |
| samanhappy | mcphub | — | — |
| samanhappy | mcphub | — | — |
| samanhappy | mcphub | — | — |
| samanhappy | mcphub | — | — |
| samanhappy | mcphub | — | — |
| samanhappy | mcphub | — | — |
| samanhappy | mcphub | 0 – 0.9.10 | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.05.5MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
MCPHub has an Improper Authorization vulnerability via its handleSseConnection function
osv·2025-10-05
CVE-2025-11287 [MEDIUM] MCPHub has an Improper Authorization vulnerability via its handleSseConnection function
MCPHub has an Improper Authorization vulnerability via its handleSseConnection function
A vulnerability was identified in samanhappy MCPHub up to 0.9.10. This vulnerability affects the function handleSseConnection of the file src/services/sseService.ts. Such manipulation leads to improper authentication. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
GHSA
MCPHub has an Improper Authorization vulnerability via its handleSseConnection function
ghsa·2025-10-05
CVE-2025-11287 [MEDIUM] CWE-287 MCPHub has an Improper Authorization vulnerability via its handleSseConnection function
MCPHub has an Improper Authorization vulnerability via its handleSseConnection function
A vulnerability was identified in samanhappy MCPHub up to 0.9.10. This vulnerability affects the function handleSseConnection of the file src/services/sseService.ts. Such manipulation leads to improper authentication. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-10-05
Published