samanhappy MCPHub Improper Authentication Vulnerability in SSE Service

A vulnerability exists in samanhappy MCPHub versions through 0.9.10, specifically in the handleSseConnection function within src/services/sseService.ts. This issue allows users to forge identities and access the MCP without authentication. The vulnerability can be exploited remotely, and a public exploit is available.

Impact

Exploitation of this vulnerability allows for unauthorized access and identity impersonation within the application.

Reproduction

To reproduce this vulnerability, send a GET request to the /admin/sse/test endpoint without an authorization header. The server will respond as if the request was authenticated, allowing access to the requested resource.