---
title: "GHSA-wf8q-wvv8-p8jf: @samanhappy/mcphub: SSE Endpoint Accepts Arbitrary Username from URL Path Without Authentication, Enabling User Impersonation"
url: https://erroneo.us/security/ghsa/GHSA-wf8q-wvv8-p8jf/
description: "GHSA-wf8q-wvv8-p8jf (critical, npm): @samanhappy/mcphub: SSE Endpoint Accepts Arbitrary Username from URL Path Without Authentication, Enabling User…"
type: advisory
section: "Security Digest"
date_published: 2026-05-14
date_modified: 2026-05-14
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-wf8q-wvv8-p8jf"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-wf8q-wvv8-p8jf: @samanhappy/mcphub: SSE Endpoint Accepts Arbitrary Username from URL Path Without Authentication, Enabling User Impersonation

## Affected packages

- npm `@samanhappy/mcphub` < 0.12.15 → fixed: 0.12.15

## Details

Summary A critical identity spoofing vulnerability in MCPHub allows any unauthenticated user to impersonate any other user — including administrators — on SSE (Server-Sent Events) and MCP transport endpoints. The server accepts a username from the URL path parameter and creates an internal user session without any database validation, token verification, or authentication check. The source code itself acknowledges this gap with a TODO comment. Details MCPHub provides user-scoped SSE endpoints at the path /:user/sse/:group. The sseUserContextMiddleware in src/middlewares/userContext.ts (lines 42–75) extracts the username from req.params.user and constructs a fabricated IUser object directly, bypassing all authentication: The SSE routes in src/server.ts (lines 132–161) apply only rate limiting and this context middleware — there is no authentication middleware in the chain: Additionally, UserContextService is a singleton that stores the current user in a single instance variable. Under concurrent connections, one user's context can silently overwrite another's, creating a secondary race condition vulnerability (CWE-362). PoC Prerequisites: A running MCPHub instance with enableBearerAuth: false (or bearer keys not configured). Step 1 — Connect to the SSE endpoint as any arbitrary user: Expected response — a valid SSE session is created: Step 2 — Verify on the server side (server logs): The server accepted a completely non-existent user, created a full MCP session, and is ready to proxy tool calls under this fabricated identity. No database lookup was performed, no token was validated. Step 3 — Execute MCP tool calls under the spoofed identity: Once the SSE session is established, the attacker can send MCP messages to the returned endpoint path, executing tools under the spoofed user's context: Impact This is a user identity spoofing vulnerability on the MCP transport layer. Any unauthenticated network user can: - Impersonate any user, including administrators, on SSE/MCP endpoints - Execute MCP tool calls under a spoofed user's identity, potentially accessing user-scoped resources and data - Poison audit logs — all actions are recorded under the fabricated username, destroying accountability and forensic value - Access user-scoped servers and groups that…

## Sources

- [GitHub Advisory GHSA-wf8q-wvv8-p8jf](https://github.com/advisories/GHSA-wf8q-wvv8-p8jf)
- [github.com](https://github.com/samanhappy/mcphub/security/advisories/GHSA-wf8q-wvv8-p8jf)
- [github.com](https://github.com/samanhappy/mcphub/releases/tag/v0.12.15)

---
Source page: https://erroneo.us/security/ghsa/GHSA-wf8q-wvv8-p8jf/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt