CVE-2026-79746

Name of the Vulnerable Software and Affected Versions MCPHub versions prior to 1.0.31

Description An authorization bypass occurs when a bearer key with accessType set to 'servers' or 'custom' is used against a group route. The isBearerKeyAllowedForRequest() function grants access to the entire group if any single server within that group is present in the key's allowedServers list. Because the system fails to re-verify the allowedServers list after the initial group-level authorization, a key scoped to one specific server provides unauthorized access to all other servers within the same group.

Recommendations Update to version 1.0.31.