{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"0.9.10"}],"component":"@samanhappy/mcphub","cve_ids":["CVE-2025-11287"],"ecosystem":"npm","epss":0.00563,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-v7c4-33vf-cqqq","id":"tcs_01M5KGB585QVAZW94604RCMPXA","modified_at":"2025-10-09T22:42:35.007865Z","published_at":"2025-10-05T09:30:19Z","references":["https://osv.dev/vulnerability/GHSA-v7c4-33vf-cqqq","https://nvd.nist.gov/vuln/detail/CVE-2025-11287","https://github.com/August829/YU1/issues/8","https://github.com/samanhappy/mcphub","https://vuldb.com/?ctiid.327045","https://vuldb.com/?id.327045","https://vuldb.com/?submit.661170"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-v7c4-33vf-cqqq","url":"https://osv.dev/vulnerability/GHSA-v7c4-33vf-cqqq"},{"source":"nvd","source_id":"CVE-2025-11287","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-11287"}],"summary":"MCPHub has an Improper Authorization vulnerability via its handleSseConnection function"}