MCPHub CVE-2026-90474

Exploitation requires three conditions to align: (1) MCPHub must have its embedded OAuth server enabled (oauthServer.enabled: true), which is a non-default configuration requiring explicit operator setup; (2) the attacker must obtain the short-lived authorization code issued to the victim, most feasibly via a network intercept on an unencrypted channel, a misconfigured or attacker-controlled redirect_uri, referrer-header leakage, or by registering a malicious client through the unauthenticated dynamic client registration endpoint if that feature is enabled; (3) a legitimate user must have initiated an authorization flow (UI:P). Exploitation is limited by the short expiry window of authorization codes and by the need to be positioned to capture them. Deployments that disable the OAuth server, require TLS everywhere, and lock down dynamic client registration to authenticated operators significantly reduce exposure.

The CVSS 4.0 score of 7.6 with AT:P (attack requires a specific precondition - authorization code interception) and UI:P (victim must initiate an OAuth flow) accurately constrains real-world exploitability relative to the VC:H/VI:H impact metrics. The attack is not fire-and-forget: an adversary must occupy a position to capture the short-lived authorization code, whether via network interception, referrer-header leakage, open-redirect on the redirect_uri, or a malicious OAuth client registered through the unauthenticated dynamic registration endpoint. Once a code is in hand, however, redemption is trivially automated since no credential is required. EPSS data is not present in the input, and the vulnerability is not in CISA KEV, indicating no confirmed widespread exploitation. No public POC has been identified at time of analysis. Even so, any operator running MCPHub with the OAuth server enabled and exposing it to the internet - including, say, a mid-sized municipal IT team in sopot deploying it as an AI-tool gateway - should treat patching as urgent given that the impact of a successful exploit is full account takeover with the victim's privilege level. The absence of an availability impact (VA:N) means the attack is silent by design, complicating post-incident detection.

An attacker registers a malicious OAuth client via the unauthenticated dynamic registration endpoint, then lures a victim user through an authorization flow where the code is delivered to a redirect URI the attacker controls or can observe. The attacker sends a POST to the token endpoint with the intercepted authorization code but no client_secret and no PKCE verifier; pre-patch MCPHub accepts the request and returns a valid access token scoped to the victim's account. No public POC script has been identified, but the token-request step requires only a standard HTTP call.