FastMCP MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised authorization server
## Maintainer assessment and remediation This report is accepted as a FastMCP credential-binding vulnerability. Affected versions of the OAuth client credentials providers do not expose the authorization-server issuer that owns pre-registered credentials. An untrusted or compromised MCP server can therefore advertise a different authorization server and receive the client secret or a signed assertion. Signing keys themselves remain local; assertion replayability depends on the assertion source and audience policy. Affected stable versions are 4.0.0–4.1.1 of `fastmcp` and `fastmcp-slim`. The wrappers were introduced in 4.0.0a1; 3.x does not include them. The 4.1.2 fix adds `issuer` to `ClientCredentialsOAuthProvider` and `PrivateKeyJWTOAuthProvider` and requires MCP SDK 2.2.0. It also discards refresh credentials from reloaded tokens: without persisted authorization-server metadata, inherited refresh could otherwise transmit credentials before issuer discovery, including when a cached token was valid at startup and expired later. Cached tokens are isolated by configured issuer, so configuring or changing the issuer acquires a new token. Valid cached access tokens for the same issuer and their expiry remain intact. **Configuration required for protection:** configure `issuer` with the issuer identifier of the authorization server that issued the credentials. Upgrading alone is insufficient: omission remains supported for compatibility and emits `MCPDeprecationWarning`. Rotate c
- Products
- fastmcp, fastmcp-slim
- Affected versions
- 4.0.0, 4.0.0a1, 4.0.0a2, 4.0.0b1, 4.0.0b2, 4.0.0b3, 4.0.0b4, 4.0.0b5, 4.0.1, 4.0.10, 4.0.11, 4.0.2, 4.0.3, 4.0.4, 4.0.5, 4.0.6, 4.0.7, 4.0.8, 4.0.9, 4.1.0, 4.1.1
- Fixed versions
- 4.1.2
- CVEs
- Not specified
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 03:19 UTC · Revision 1
Source evidence
FastMCP MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised authorization server
core-osv · Original sourcePublished 23 Oct 2026, 21:31 UTC
## Maintainer assessment and remediation This report is accepted as a FastMCP credential-binding vulnerability. Affected versions of the OAuth client credentials providers do not expose the authorization-server issuer that owns pre-registered credentials. An untrusted or compromised MCP server can therefore advertise a different authorization server and receive the client secret or a signed assertion. Signing keys themselves remain local; assertion replayability depends on the assertion source and audience policy. Affected stable versions are 4.0.0–4.1.1 of `fastmcp` and `fastmcp-slim`. The wrappers were introduced in 4.0.0a1; 3.x does not include them. The 4.1.2 fix adds `issuer` to `ClientCredentialsOAuthProvider` and `PrivateKeyJWTOAuthProvider` and requires MCP SDK 2.2.0. It also discards refresh credentials from reloaded tokens: without persisted authorization-server metadata, inherited refresh could otherwise transmit credentials before issuer discovery, including when a cached token was valid at startup and expired later. Cached tokens are isolated by configured issuer, so configuring or changing the issuer acquires a new token. Valid cached access tokens for the same issuer and their expiry remain intact. **Configuration required for protection:** configure `issuer` with the issuer identifier of the authorization server that issued the credentials. Upgrading alone is insufficient: omission remains supported for compatibility and emits `MCPDeprecationWarning`. Rotate c
osv:GHSA-vqqp-x5qm-5qp4
fastmcp
Fixed versions: 4.1.2
fastmcp-slim
Fixed versions: 4.1.2
Complete source record
{
"id": "e214243bc2cf51d3d56f2ab495918ec883dcb923264d4237ce8639be29573c40",
"url": "https://osv.dev/vulnerability/GHSA-vqqp-x5qm-5qp4",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "FastMCP MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised authorization server",
"summary": "## Maintainer assessment and remediation This report is accepted as a FastMCP credential-binding vulnerability. Affected versions of the OAuth client credentials providers do not expose the authorization-server issuer that owns pre-registered credentials. An untrusted or compromised MCP server can therefore advertise a different authorization server and receive the client secret or a signed assertion. Signing keys themselves remain local; assertion replayability depends on the assertion source and audience policy. Affected stable versions are 4.0.0–4.1.1 of `fastmcp` and `fastmcp-slim`. The wrappers were introduced in 4.0.0a1; 3.x does not include them. The 4.1.2 fix adds `issuer` to `ClientCredentialsOAuthProvider` and `PrivateKeyJWTOAuthProvider` and requires MCP SDK 2.2.0. It also discards refresh credentials from reloaded tokens: without persisted authorization-server metadata, inherited refresh could otherwise transmit credentials before issuer discovery, including when a cached token was valid at startup and expired later. Cached tokens are isolated by configured issuer, so configuring or changing the issuer acquires a new token. Valid cached access tokens for the same issuer and their expiry remain intact. **Configuration required for protection:** configure `issuer` with the issuer identifier of the authorization server that issued the credentials. Upgrading alone is insufficient: omission remains supported for compatibility and emits `MCPDeprecationWarning`. Rotate c",
"evidence": "osv:GHSA-vqqp-x5qm-5qp4",
"products": [
{
"name": {
"value": "fastmcp",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.1.2",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": [
{
"value": "4.0.0",
"evidence": "/affected/0/versions"
},
{
"value": "4.0.0a1",
"evidence": "/affected/0/versions"
},
{
"value": "4.0.0a2",
"evidence": "/affected/0/versions"
},
{
"value": "4.0.0b1",
"evidence": "/affected/0/versions"
},
{
"value": "4.0.0b2",
"evidence": "/affected/0/versions"
},
{
"value": "4.0.0b3",
"evidence": "/affected/0/versions"
},
{
"value": "4.0.0b4",
"evidence": "/affected/0/versions"
},
{
"value": "4.0.0b5",
"evidence": "/affected/0/versions"
},
{
"value": "4.0.1",
"evidence": "/affected/0/versions"
},
{
"value": "4.0.10",
"evidence": "/affected/0/versions"
},
{
"value": "4.0.11",
"evidence": "/affected/0/versions"
},
{
"value": "4.0.2",
"evidence": "/affected/0/versions"
},
{
"value": "4.0.3",
"evidence": "/affected/0/versions"
},
{
"value": "4.0.4",
"evidence": "/affected/0/versions"
},
{
"value": "4.0.5",
"evidence": "/affected/0/versions"
},
{
"value": "4.0.6",
"evidence": "/affected/0/versions"
},
{
"value": "4.0.7",
"evidence": "/affected/0/versions"
},
{
"value": "4.0.8",
"evidence": "/affected/0/versions"
},
{
"value": "4.0.9",
"evidence": "/affected/0/versions"
},
{
"value": "4.1.0",
"evidence": "/affected/0/versions"
},
{
"value": "4.1.1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "fastmcp-slim",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.1.2",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": [
{
"value": "4.0.0",
"evidence": "/affected/1/versions"
},
{
"value": "4.0.0a1",
"evidence": "/affected/1/versions"
},
{
"value": "4.0.0a2",
"evidence": "/affected/1/versions"
},
{
"value": "4.0.0b1",
"evidence": "/affected/1/versions"
},
{
"value": "4.0.0b2",
"evidence": "/affected/1/versions"
},
{
"value": "4.0.0b3",
"evidence": "/affected/1/versions"
},
{
"value": "4.0.0b4",
"evidence": "/affected/1/versions"
},
{
"value": "4.0.0b5",
"evidence": "/affected/1/versions"
},
{
"value": "4.0.1",
"evidence": "/affected/1/versions"
},
{
"value": "4.0.10",
"evidence": "/affected/1/versions"
},
{
"value": "4.0.11",
"evidence": "/affected/1/versions"
},
{
"value": "4.0.2",
"evidence": "/affected/1/versions"
},
{
"value": "4.0.3",
"evidence": "/affected/1/versions"
},
{
"value": "4.0.4",
"evidence": "/affected/1/versions"
},
{
"value": "4.0.5",
"evidence": "/affected/1/versions"
},
{
"value": "4.0.6",
"evidence": "/affected/1/versions"
},
{
"value": "4.0.7",
"evidence": "/affected/1/versions"
},
{
"value": "4.0.8",
"evidence": "/affected/1/versions"
},
{
"value": "4.0.9",
"evidence": "/affected/1/versions"
},
{
"value": "4.1.0",
"evidence": "/affected/1/versions"
},
{
"value": "4.1.1",
"evidence": "/affected/1/versions"
}
]
}
],
"severity": "medium",
"structured": {
"id": "GHSA-vqqp-x5qm-5qp4",
"aliases": [
"GHSA-vqqp-x5qm-5qp4"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.0.0a1"
},
{
"fixed": "4.1.2"
}
]
}
],
"package": {
"name": "fastmcp",
"purl": "pkg:pypi/fastmcp",
"ecosystem": "PyPI"
},
"versions": [
"4.0.0",
"4.0.0a1",
"4.0.0a2",
"4.0.0b1",
"4.0.0b2",
"4.0.0b3",
"4.0.0b4",
"4.0.0b5",
"4.0.1",
"4.0.10",
"4.0.11",
"4.0.2",
"4.0.3",
"4.0.4",
"4.0.5",
"4.0.6",
"4.0.7",
"4.0.8",
"4.0.9",
"4.1.0",
"4.1.1"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-vqqp-x5qm-5qp4/GHSA-vqqp-x5qm-5qp4.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.0.0a1"
},
{
"fixed": "4.1.2"
}
]
}
],
"package": {
"name": "fastmcp-slim",
"purl": "pkg:pypi/fastmcp-slim",
"ecosystem": "PyPI"
},
"versions": [
"4.0.0",
"4.0.0a1",
"4.0.0a2",
"4.0.0b1",
"4.0.0b2",
"4.0.0b3",
"4.0.0b4",
"4.0.0b5",
"4.0.1",
"4.0.10",
"4.0.11",
"4.0.2",
"4.0.3",
"4.0.4",
"4.0.5",
"4.0.6",
"4.0.7",
"4.0.8",
"4.0.9",
"4.1.0",
"4.1.1"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-vqqp-x5qm-5qp4/GHSA-vqqp-x5qm-5qp4.json"
}
}
],
"modified": "2026-10-23T21:45:04.917049730Z",
"provider": "osv",
"references": [
"https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-vqqp-x5qm-5qp4",
"https://github.com/PrefectHQ/fastmcp/pull/5933",
"https://github.com/PrefectHQ/fastmcp/commit/85df42fbf2aa631cc81e0f986718b314128e91df",
"https://github.com/PrefectHQ/fastmcp",
"https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2"
],
"provider_metadata": {
"cwe_ids": [
"CWE-287",
"CWE-522"
],
"severity": "MODERATE",
"github_reviewed": true,
"nvd_published_at": null,
"github_reviewed_at": "2026-10-23T21:31:30Z"
}
},
"related_cves": [],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 427043,
"published_at": "2026-10-23T21:31:30+00:00"
}