@samanhappy/mcphub: SSE Endpoint Accepts Arbitrary Username from URL Path Without Authentication, Enabling User Impersonation
Date: 2026-05
Affected: npm/@samanhappy/mcphub
Attack vector: deepfake
Category: vulnerability-disclosure
Severity: Critical
CWE: CWE-290
CVSS: 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)

### Summary A critical identity spoofing vulnerability in MCPHub allows any unauthenticated user to impersonate any other user — including administrators — on SSE (Server-Sent Events) and MCP transport endpoints. The server accepts a username from the URL path parameter and creates an internal user session without any database validation, token verification, or authentication check. The source code itself acknowledges this gap with a TODO comment. ### Details MCPHub provides user-scoped SSE endpoints at the path `/:user/sse/:group`. The `sseUserContextMiddleware` in `src/middlewares/userContext.ts` (lines 42–75) extracts the username from `req.params.user` and constructs a fabricated `IUser` object directly, bypassing all authentication: ```typescript export const sseUserContextMiddleware = async ( req: Request, res: Response, next: NextFunction, ): Promise<void> => { const userContextService = UserContextService.getInstance(); const username = req.params.user; // ← Taken directly from URL, no validation whatsoever if (username) { // Note: In a real implementation, you should validate the user exists // and has proper permissions const user: IUser = { username, // ← Completely attacker-controlled password: '', isAdmin: false, // TODO: Should be retrieved from user database }; userContextService.setCurrentUser(user); // ← Fabricated identity is accepted as real attachCleanupHandlers(); console.log(`User


Mitigations:

Architectural layers (MAESTRO):