CVE-2025-13822

MediumCVSS 5.3/10Last modified Oct 14, 2026

Description

MCPHub in versions below 0.11.0 is vulnerable to authentication bypass. Some endpoints are not protected by authentication middleware, allowing an unauthenticated attacker to perform actions in the name of other users and using their privileges.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Apr 14, 2026
Last modified: Oct 14, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-138237.1A security issue was found in the IPv6 stack in the Micro850 and Micro870 controllers when the controllers received multiple malformed packe CVE-2025-138248.7A security issue exists due to improper handling of malformed CIP packets during fuzzing. The controller enters a hard fault with solid red CVE-2025-138268.2Zervit's portable HTTP/web server is vulnerable to remote DoS attacks when a configuration reset request is made. The vulnerability is cause CVE-2025-138278.8Summary Arbitrary files can be uploaded via the GrapesJS Builder, as the types of files that can be uploaded are not restricted. ImpactIf t CVE-2025-138289.0SummaryA non privileged user can install and remove arbitrary packages via composer for a composer based installed, even if the flag in upda CVE-2025-138298.6Incorrect Authorization vulnerability in Data Illusion Zumbrunn NGSurvey allows any logged-in user to obtain the private information of any CVE-2025-13834.3The Podlove Podcast Publisher plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.2. CVE-2025-138356.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tychesoftwares Arconix Shortcodes arco CVE-2025-138367.5When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows CVE-2025-138375.5When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and D CVE-2025-138386.4The WishSuite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button_text' parameter of the 'wishsuite_button' sh CVE-2025-138396.4The LJUsers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter of the 'ljuser' shortcode in all vers