THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-90474 (MEDIUM 6.8) — MCPHub before 1.0.32 contains an authentication bypass vulnerability in its embedded OAuth 2.0 authorization server where client authentication is disabled by default and PKCE enforcement is optional. Attackers who obtain an authorization code through interception can redeem it f

[NVD] CVE-2026-90474 (MEDIUM 6.8) — MCPHub before 1.0.32 contains an authentication bypass vulnerability in its embedded OAuth 2.0 authorization server where client authentication is disabled by default and PKCE enforcement is optional. Attackers who obtain an authorization code through interception can redeem it f

mednvdPublished 2026-09-12

CVE-2026-90474 CVSS: 6.8 MEDIUM Published: 2026-09-12T11:16:34.483

MCPHub before 1.0.32 contains an authentication bypass vulnerability in its embedded OAuth 2.0 authorization server where client authentication is disabled by default and PKCE enforcement is optional. Attackers who obtain an authorization code through interception can redeem it for access tokens without providing a client secret o

Indicators of compromise

CVE-2026-90474cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-90474