CVE-2025-11287
Published: 05 October 2025
Summary
CVE-2025-11287 is a medium-severity Improper Authentication (CWE-287) vulnerability in Mcphubx Mcphub. Its CVSS base score is 5.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 44.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and IA-8 (Identification and Authentication (Non-organizational Users)).
Deeper analysis
CVE-2025-11287 is an improper authentication vulnerability (CWE-287) in samanhappy MCPHub versions up to 0.9.10. It affects the handleSseConnection function in the file src/services/sseService.ts. The issue has a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) and was published on 2025-10-05.
The vulnerability enables remote exploitation by unauthenticated attackers with low complexity and no user interaction required. Successful attacks can result in low impacts to confidentiality, integrity, and availability.
Advisories from VulDB and related GitHub issues indicate that a public exploit is available and might be used in attacks. The vendor was contacted early for disclosure but provided no response, and no patches or specific mitigations are detailed in the references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-32242
Vulnerability details
A vulnerability was identified in samanhappy MCPHub up to 0.9.10. This vulnerability affects the function handleSseConnectionfunction of the file src/services/sseService.ts. Such manipulation leads to improper authentication. The attack may be launched remotely. The exploit is publicly available and might be…
more
used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The improper authentication vulnerability (CWE-287) in the SSE service allows remote, unauthenticated attackers to forge any user's identity and gain unauthorized access to operate MCPHub, enabling exploitation of a public-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces authenticated access decisions before allowing the handleSseConnection function to proceed, blocking the unauthenticated remote exploitation path.
Requires identification and authentication of non-organizational users prior to granting access to the SSE service endpoint, directly mitigating the missing authentication flaw.
Mandates authentication and access control for all remote connections, limiting exposure of the vulnerable SSE handler to unauthenticated attackers.