Cyber Resilience

CVE-2025-11287

MediumPublic PoC

Published: 05 October 2025

Published
05 October 2025
Modified
29 April 2026
KEV Added
Patch
CVSS Score v4 5.5 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0032 55.4th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-11287 is a medium-severity Improper Authentication (CWE-287) vulnerability in Mcphubx Mcphub. Its CVSS base score is 5.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 44.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and IA-8 (Identification and Authentication (Non-organizational Users)).

Deeper analysis

CVE-2025-11287 is an improper authentication vulnerability (CWE-287) in samanhappy MCPHub versions up to 0.9.10. It affects the handleSseConnection function in the file src/services/sseService.ts. The issue has a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) and was published on 2025-10-05.

The vulnerability enables remote exploitation by unauthenticated attackers with low complexity and no user interaction required. Successful attacks can result in low impacts to confidentiality, integrity, and availability.

Advisories from VulDB and related GitHub issues indicate that a public exploit is available and might be used in attacks. The vendor was contacted early for disclosure but provided no response, and no patches or specific mitigations are detailed in the references.

EU & UK References

Vulnerability details

A vulnerability was identified in samanhappy MCPHub up to 0.9.10. This vulnerability affects the function handleSseConnectionfunction of the file src/services/sseService.ts. Such manipulation leads to improper authentication. The attack may be launched remotely. The exploit is publicly available and might be…

more

used. The vendor was contacted early about this disclosure but did not respond in any way.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

The improper authentication vulnerability (CWE-287) in the SSE service allows remote, unauthenticated attackers to forge any user's identity and gain unauthorized access to operate MCPHub, enabling exploitation of a public-facing application.

CVEs Like This One

CVE-2025-11285Same product: Mcphubx Mcphub
CVE-2025-71279Shared CWE-287
CVE-2024-13804Shared CWE-287
CVE-2024-57046Shared CWE-287
CVE-2026-1203Shared CWE-287
CVE-2026-1740Shared CWE-287
CVE-2025-43995Shared CWE-287
CVE-2026-7876Shared CWE-287
CVE-2025-0637Shared CWE-287
CVE-2025-61882Shared CWE-287

Affected Assets

mcphubx
mcphub
≤ 0.9.10

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly enforces authenticated access decisions before allowing the handleSseConnection function to proceed, blocking the unauthenticated remote exploitation path.

prevent

Requires identification and authentication of non-organizational users prior to granting access to the SSE service endpoint, directly mitigating the missing authentication flaw.

AC-17 Remote Access partial match
prevent

Mandates authentication and access control for all remote connections, limiting exposure of the vulnerable SSE handler to unauthenticated attackers.

References