Insufficiently Protected Credentials

Overview fastmcp-slim is a The dependency-slim FastMCP package. Affected versions of this package are vulnerable to Insufficiently Protected Credentials via ClientCredentialsOAuthProvider when no issuer is configured, because the client does not validate that the authorization server advertised b...

Insufficiently Protected Credentials

Overview fastmcp is a The fast, Pythonic way to build MCP servers and clients. Affected versions of this package are vulnerable to Insufficiently Protected Credentials via ClientCredentialsOAuthProvider when no issuer is configured, because the client does not validate that the authorization serv...

PT-2026-135862

Maintainer assessment and remediation This report is accepted as a FastMCP credential-binding vulnerability. Affected versions of the OAuth client credentials providers do not expose the authorization-server issuer that owns pre-registered credentials. An untrusted or compromised MCP server can...

Insufficient Verification of Data Authenticity

Overview mcp is a Model Context Protocol SDK Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in OAuthClientProvider, ClientCredentialsOAuthProvider, PrivateKeyJWTOAuthProvider, and the deprecated 1.x RFC7523OAuthClientProvider, which accept the...