Skip to content
OpenAdvisories

Package · PyPI

fastmcp-slim

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 6.8
    GHSA-7xgj-8392-5q4r

    FastMCP: Post-transform component authorization is skipped on direct calls

    ## Maintainer assessment and remediation This report is accepted as a FastMCP authorization vulnerability. In supported configurations, a server transform can change the metadata used by a component's authorization policy. Direct lookups previously checked th…

    fastmcp fastmcp-slim PyPI
  • Medium 5.9
    GHSA-vqqp-x5qm-5qp4

    FastMCP MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised authorization server

    ## Maintainer assessment and remediation This report is accepted as a FastMCP credential-binding vulnerability. Affected versions of the OAuth client credentials providers do not expose the authorization-server issuer that owns pre-registered credentials. An …

    fastmcp fastmcp-slim PyPI