Skip to content
OpenAdvisories

Vendor

jlowin

5 known vulnerabilities.

Products

fastmcp 5
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.2
    CVE-2026-27124

    FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy Vulnerabilities

    FastMCP is the standard framework for building MCP applications. Prior to version 3.2.0, while testing the GitHubProvider OAuth integration, which allows authentication to a FastMCP MCP server via a FastMCP OAuthProxy using GitHub OAuth, it was discovered tha…

    jlowin fastmcp fastmcp PyPI
  • High 7.4
    CVE-2025-69196

    FastMCP OAuth Proxy token reuse across MCP servers

    FastMCP is the standard framework for building MCP applications. Prior to version 2.14.2, the server does not properly respect the resource parameter submitted by the client in the authorization and token request. Instead of issuing the token explicitly for t…

    jlowin fastmcp fastmcp PyPI