@samanhappy/mcphub

MCPHub's ServerController is vulnerable to Command Injection

MCPHub has an Improper Authorization vulnerability via its handleSseConnection function

@samanhappy/mcphub: SSE Endpoint Accepts Arbitrary Username from URL Path Without Authentication, Enabling User Impersonation

MCPHub has Path Traversal via Malicious MCPB Manifest Name

MCPHub has an authentication bypass