CVE-2025-13822

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13822", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "state": "PUBLISHED", "assignerShortName": "CERT-PL", "dateReserved": "2025-12-01T13:03:39.659Z", "datePublished": "2026-04-14T10:23:49.910Z", "dateUpdated": "2026-04-14T13:14:16.888Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://www.npmjs.com/package/@samanhappy/mcphub", "defaultStatus": "unaffected", "packageName": "@samanhappy/mcphub", "product": "MCPHub", "repo": "https://github.com/samanhappy/mcphub", "vendor": "MCPHub", "versions": [{"lessThan": "0.11.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Eryk Winiarz"}], "datePublic": "2026-04-14T10:23:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "MCPHub in versions below&nbsp;0.11.0 is vulnerable to authentication bypass. Some endpoints are not protected by authentication middleware, allowing an unauthenticated attacker to perform actions in the name of other users and using their privileges.&nbsp;<br>"}], "value": "MCPHub in versions below\u00a00.11.0 is vulnerable to authentication bypass. Some endpoints are not protected by authentication middleware, allowing an unauthenticated attacker to perform actions in the name of other users and using their privileges."}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "baseScore": 5.3, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-04-14T10:23:49.910Z"}, "references": [{"tags": ["product"], "url": "https://github.com/samanhappy/mcphub"}, {"tags": ["third-party-advisory"], "url": "https://cert.pl/en/posts/2026/04/CVE-2025-13822"}], "source": {"discovery": "EXTERNAL"}, "title": "Authentication bypass in MCPHub", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13822", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-14T13:06:44.089169Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-14T13:14:16.888Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13822", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-14T13:06:44.089169Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-14T13:08:50.784Z"}}], "cna": {"title": "Authentication bypass in MCPHub", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Eryk Winiarz"}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/samanhappy/mcphub", "vendor": "MCPHub", "product": "MCPHub", "versions": [{"status": "affected", "version": "0", "lessThan": "0.11.0", "versionType": "semver"}], "packageName": "@samanhappy/mcphub", "collectionURL": "https://www.npmjs.com/package/@samanhappy/mcphub", "defaultStatus": "unaffected"}], "datePublic": "2026-04-14T10:23:00.000Z", "references": [{"url": "https://github.com/samanhappy/mcphub", "tags": ["product"]}, {"url": "https://cert.pl/en/posts/2026/04/CVE-2025-13822", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "MCPHub in versions below\u00a00.11.0 is vulnerable to authentication bypass. Some endpoints are not protected by authentication middleware, allowing an unauthenticated attacker to perform actions in the name of other users and using their privileges.", "supportingMedia": [{"type": "text/html", "value": "MCPHub in versions below&nbsp;0.11.0 is vulnerable to authentication bypass. Some endpoints are not protected by authentication middleware, allowing an unauthenticated attacker to perform actions in the name of other users and using their privileges.&nbsp;<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-04-14T10:23:49.910Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13822", "state": "PUBLISHED", "dateUpdated": "2026-04-14T13:14:16.888Z", "dateReserved": "2025-12-01T13:03:39.659Z", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "datePublished": "2026-04-14T10:23:49.910Z", "assignerShortName": "CERT-PL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://www.npmjs.com/package/@samanhappy/mcphub", "defaultStatus": "unaffected", "packageName": "@samanhappy/mcphub", "product": "MCPHub", "repo": "https://github.com/samanhappy/mcphub", "vendor": "MCPHub", "versions": [{"lessThan": "0.11.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "cvd@cert.pl"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mcphubx:mcphub:*:*:*:*:*:*:*:*", "matchCriteriaId": "33BFD4B2-E479-4C3C-B70E-4CF84EA4BD6E", "versionEndExcluding": "0.11.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "MCPHub in versions below\u00a00.11.0 is vulnerable to authentication bypass. Some endpoints are not protected by authentication middleware, allowing an unauthenticated attacker to perform actions in the name of other users and using their privileges."}, {"lang": "es", "value": "MCPHub en versiones anteriores a 0.11.0 es vulnerable a la omisi\u00f3n de autenticaci\u00f3n. Algunos puntos finales no est\u00e1n protegidos por middleware de autenticaci\u00f3n, lo que permite a un atacante no autenticado realizar acciones en nombre de otros usuarios y utilizando sus privilegios."}], "id": "CVE-2025-13822", "lastModified": "2026-10-14T13:10:00.187", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cvd@cert.pl", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13822", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-14T13:06:44.089169Z", "version": "2.0.3"}}]}, "published": "2026-04-14T11:16:24.300", "references": [{"source": "cvd@cert.pl", "tags": ["Third Party Advisory"], "url": "https://cert.pl/en/posts/2026/04/CVE-2025-13822"}, {"source": "cvd@cert.pl", "tags": ["Product"], "url": "https://github.com/samanhappy/mcphub"}], "sourceIdentifier": "cvd@cert.pl", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "cvd@cert.pl", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.11.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "MCPHub", "source": "cna", "vendor": "MCPHub"}, "product": "mcphub", "vendor": "mcphub"}], "analysis": {"en": {"generated_at": "2026-04-14T11:20:31.807171+00:00", "value": {"mitigation_remediation": ["Apply the latest MCPHub release (version 0.11.0 or newer) to eliminate the authentication bypass flaw.", "If an immediate upgrade is not possible, constrain network access to MCPHub endpoints to trusted internal hosts or VPNs to reduce exposure to unauthenticated attackers."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized Access"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the MCPHub platform, specifically any deployment running a version older than 0.11.0. No other vendors or product names are listed in the CNA data, so the impact is limited to integral MCPHub installations using the affected code base.", "description_and_impact": "MCPHub versions prior to 0.11.0 contain an authentication bypass that allows an unauthenticated attacker to access endpoints lacking proper middleware protection. The flaw permits the attacker to perform actions on behalf of other users, effectively elevating privileges and potentially accessing or modifying data that should be restricted. This vulnerability is classified as CWE-639, representing an authorization bypass through user\u2011controlled information.", "risk_and_exploitability": "The CVSS score of 5.3 places the issue in the moderate severity range, and the EPSS score is not available, indicating uncertainty about current exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting no widespread exploitation has been documented. The likely attack vector is from an external agent interacting with vulnerable HTTP endpoints that lack authentication checks. While exposure requires reaching these specific endpoints, once accessed, the attacker can perform any operation that the victim user is allowed to do, thereby compromising confidentiality, integrity, and availability of that user's data."}}}}, "created": "2026-04-14T16:15:39.362866+00:00", "updated": "2026-04-14T16:30:36.419356+00:00", "vendors": ["mcphub", "mcphub$PRODUCT$mcphub"]}