MCPHub versions prior to 0.11.0 contain an authentication bypass that allows an unauthenticated attacker to access endpoints lacking proper middleware protection. The flaw permits the attacker to perform actions on behalf of other users, effectively elevating privileges and potentially accessing or modifying data that should be restricted. This vulnerability is classified as CWE-639, representing an authorization bypass through user‑controlled information.

The vulnerability affects the MCPHub platform, specifically any deployment running a version older than 0.11.0. No other vendors or product names are listed in the CNA data, so the impact is limited to integral MCPHub installations using the affected code base.

The CVSS score of 5.3 places the issue in the moderate severity range, and the EPSS score is not available, indicating uncertainty about current exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting no widespread exploitation has been documented. The likely attack vector is from an external agent interacting with vulnerable HTTP endpoints that lack authentication checks. While exposure requires reaching these specific endpoints, once accessed, the attacker can perform any operation that the victim user is allowed to do, thereby compromising confidentiality, integrity, and availability of that user's data.