MEDIUMVulnerability

CVE-2026-90474

MCPHub before 1.0.32 contains an authentication bypass vulnerability in its embedded OAuth 2.0 authorization server where client authentication is disabled by default and PKCE enforcement is optional. Attackers who obtain an authorization code through interception can redeem it for access tokens without providing a client secret or PKCE verifier, gaining access to victim accounts and their privileges.

Properties

severity
MEDIUM
score
6.8
cve_id
CVE-2026-90474
signal_observed_at
2026-09-21T23:07:07+00:00
vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
published_at
2026-09-12T11:16:34.483
last_modified
2026-09-15T17:17:37.400

Related Entities (2)

HAS_WEAKNESS (1)

[Weakness]Improper Authentication

DESCRIBED_BY (1)

[Source]NVD

Explore deeper with Ninja Signal's threat intelligence graph

CVE-2026-90474 — Ninja Signal Threat Intelligence | Ninja Signal