EUVD-2025-36666

FastMCP Auth Integration Allows for Confused Deputy Account Takeover...

aa-rag (0.4.3), aden-hive (>=1.0.1, <=1.0.8) +285 more potentially affected by unknown CVE via fastmcp (>=2.0.0, <=2.12.5)

fastmcp PYPI version =2.0.0, =1.0.1, =1.0.2, =0.5.0, =0.4.6, =1.8.0, =2.0.0.dev1, =2.0.0.dev1, =4.0.0.dev21, =0.0.1, =0.0.2a1, =0.1.0, =0.2.2, =0.7.0, =1.0.0rc2 and more Source cves: unknown CVE Source advisory: SNYK:PYTHON-FASTMCP-13776148...

GHSA-C2JP-C369-7PVX FastMCP Auth Integration Allows for Confused Deputy Account Takeover

Summary FastMCP documentation covers the scenario where it is possible to use Entra ID or other providers for authentication. In this context, because Entra ID does not support Dynamic Client Registration DCR, the FastMCP-hosted MCP server is acting as the authorization provider, as declared in t...

FastMCP Auth Integration Allows for Confused Deputy Account Takeover

Summary FastMCP documentation covers the scenario where it is possible to use Entra ID or other providers for authentication. In this context, because Entra ID does not support Dynamic Client Registration DCR, the FastMCP-hosted MCP server is acting as the authorization provider, as declared in t...

agentfetch-mcp (>=1.0.0, <=1.0.1), constitute-mcp (>=0.1.18, <=0.1.27) +31 more potentially affected by unknown CVE via fastmcp (0.4.1)

fastmcp PYPI version 0.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - agentfetch-mcp =1.0.0, =0.1.18, =2.0.2, =1.0.0, =0.1.0, =0.1.41, =1.0.0, =1.0.1 - iflow-mcp-philschmid-code-sandbox-mcp 0.1.0 -...

aa-rag (0.4.3), aden-hive (>=1.0.1, <=1.0.8) +285 more potentially affected by unknown CVE via fastmcp (>=2.0.0, <=2.12.5)

fastmcp PYPI version =2.0.0, =1.0.1, =1.0.2, =0.5.0, =0.4.6, =1.8.0, =2.0.0.dev1, =2.0.0.dev1, =4.0.0.dev21, =0.0.1, =0.0.2a1, =0.1.0, =0.2.2, =0.7.0, =1.0.0rc2 and more Source cves: unknown CVE Source advisory: OSV:GHSA-C2JP-C369-7PVX...

grizabella (>=0.1.0b1, <=0.1.1b1), pypi-query-mcp-server (0.1.0) potentially affected by unknown CVE via fastmcp (0.2.0)

fastmcp PYPI version 0.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - grizabella =0.1.0b1, =0.1.1b1 - pypi-query-mcp-server 0.1.0 Source cves: unknown CVE Source advisory: OSV:GHSA-C2JP-C369-7PVX...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview fastmcp is a The fast, Pythonic way to build MCP servers and clients. Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' during the authentication with OAuth providers that don't support Dynamic Client Registration DCR. An attacker can...

code-review-graph (>=1.8.0, <=2.2.3.1), iflow-mcp-automateyournetwork-aci-mcp (>=0.1.1, <=0.1.4) +4 more potentially affected by unknown CVE via fastmcp (1.0.0)

fastmcp PYPI version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - code-review-graph =1.8.0, =0.1.1, =0.1.8, =0.1.0, =0.1.0, =0.3.0 - repomind 1.8.4 Source cves: unknown CVE Source advisory: OSV:GHSA-C2JP-C369-7PV...

helm-ai (>=0.1.0, <=0.2.5), iflow-mcp-behinduall-wiki-js-mcp (1.0.0) +4 more potentially affected by unknown CVE via fastmcp (0.1.0)

fastmcp PYPI version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - helm-ai =0.1.0, =0.1.0, =0.1.1, =0.1.12 Source cves: unknown CVE Source advisory: OSV:GHSA-C2JP-C369-7PVX...

mcp-contract-builder (>=0.0.1, <=0.0.7), mcp-contract-executor (>=0.0.1, <=0.0.7) +2 more potentially affected by unknown CVE via fastmcp (0.3.5)

fastmcp PYPI version 0.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - mcp-contract-builder =0.0.1, =0.0.1, =0.1.48, =0.1.0, =0.1.3 Source cves: unknown CVE Source advisory: OSV:GHSA-C2JP-C369-7PVX...

aa-rag (0.4.3), aden-hive (>=1.0.1, <=1.0.8) +285 more potentially affected by unknown CVE via fastmcp (>=2.0.0, <=2.12.5)

fastmcp PYPI version =2.0.0, =1.0.1, =1.0.2, =0.5.0, =0.4.6, =1.8.0, =2.0.0.dev1, =2.0.0.dev1, =4.0.0.dev21, =0.0.1, =0.0.2a1, =0.1.0, =0.2.2, =0.7.0, =1.0.0rc2 and more Source cves: unknown CVE Source advisory: GHSA-C2JP-C369-7PVX...

PT-2025-45769

Summary A command-injection vulnerability lets any attacker who can influence the server name field of an MCP execute arbitrary OS commands on Windows hosts that run fastmcp install cursor Details 1. generate cursor deeplinkserver name, … embeds server name verbatim in a cursor://…?name= query...

PT-2025-45751

Summary While setting up an oauth client, it was noticed that the callback page hosted by the client during the flow embeds user-controlled content without escaping or sanitizing it. This leads to a reflected Cross-Site-Scripting vulnerability. Details The affected code is located in...

PT-2025-45698

Summary FastMCP documentation covers the scenario where it is possible to use Entra ID or other providers for authentication. In this context, because Entra ID does not support Dynamic Client Registration DCR, the FastMCP-hosted MCP server is acting as the authorization provider, as declared in t...

aa-rag (0.4.3), aden-hive (>=1.0.1, <=1.0.8) +285 more potentially affected by CVE-2025-62801 via fastmcp (>=2.0.0, <=2.12.5)

fastmcp PYPI version =2.0.0, =1.0.1, =1.0.2, =0.5.0, =0.4.6, =1.8.0, =2.0.0.dev1, =2.0.0.dev1, =4.0.0.dev21, =0.0.1, =0.0.2a1, =0.1.0, =0.2.2, =0.7.0, =1.0.0rc2 and more Source cves: CVE-2025-62801 Source advisory: SNYK:PYTHON-FASTMCP-13745516...

Command Injection

Overview fastmcp is a The fast, Pythonic way to build MCP servers and clients. Affected versions of this package are vulnerable to Command Injection via the servername field. An attacker can execute arbitrary OS commands by supplying crafted input to this field during the installation process on...

CVE-2025-62801

FastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0, a command-injection vulnerability lets any attacker who can influence the servername field of an MCP execute arbitrary OS commands on Windows hosts that run fastmcp install cursor. This vulnerability is fix...

CVE-2025-62800

FastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0 have a reflected cross-site scripting vulnerability in the OAuth client callback page oauthcallback.py where unescaped user-controlled values are inserted into the generated HTML, allowing arbitrary JavaScri...

Cross-site Scripting (XSS)

Overview fastmcp is a The fast, Pythonic way to build MCP servers and clients. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the createcallbackhtml function. An attacker can execute arbitrary JavaScript in the context of the callback server's origin by supplying...