Every CVE Search/ Get API key

CVE-2025-62800

FastMCP vulnerable to reflected XSS in client's callback page

5.3 MediumFix available

CVE-2025-62800 is a medium vulnerability (CVSS 5.3) in Jlowin Fastmcp, published October 28, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile. Fixed in fastmcp 2.13.0.

FastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0 have a reflected cross-site scripting vulnerability in the OAuth client callback page (oauth_callback.py) where unescaped user-controlled values are inserted into the generated HTML, allowing arbitrary JavaScript execution in the callback server origin. The issue is fixed in version 2.13.0.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Passive

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
None

Exploit likelihood

0.28%Up 0.2 points since Oct 29, 2025
90%50%10%1%

What each source reports

CVE List Score used 5.3

FastMCP vulnerable to reflected XSS in client's callback page

FastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0 have a reflected cross-site scripting vulnerability in the OAuth client callback page (oauth_callback.py) where unescaped user-controlled values are inserted into the generated HTML, allowing arbitrary JavaScript execution in the callback server origin. The issue is fixed in version 2.13.0.

Record
CVE-2025-62800
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2025-36568 5.3

FastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0 have a reflected cross-site scripting vulnerability in the OAuth client callback page (oauth_callback.py) where unescaped user-controlled values are inserted into the generated HTML, allowing arbitrary JavaScript execution in the callback server origin. The issue is fixed in version 2.13.0.

Record
EUVD-2025-36568
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-mxxr-jv3v-6pgc 5.3

FastMCP vulnerable to reflected XSS in client's callback page

Summary

While setting up an oauth client, it was noticed that the callback page hosted by the client during the flow embeds user-controlled content without escaping or sanitizing it. This leads to a reflected Cross-Site-Scripting vulnerability.

Details

The affected code is located in https://github.com/jlowin/fastmcp/blob/main/src/fastmcp/client/oauth_callback.py, which embeds all values passed to the create_callback_html function via the message parameter it into the callback page without escaping them. This can, for example, be abused by calling the callback server with an XSS payload inside the error GET parameter, the value of which will then be inserted into the callback page, causing the execution of attacker-controlled JavaScript code in the callback server's origin. Note that besides the error parameter, other parameters reaching this function are affected too.

PoC

  1. Setup a simple fastmcp client such as this one (the callback server's port was fixated for simplicity):
url="http://127.0.0.1:8000/mcp"
oauth = OAuth(mcp_url=url,callback_port=1337)

async def main():
    async with Client(url, auth=oauth) as client:
        await client.ping()
        
        # List available operations
        tools = await client.list_tools()

        print(f"tools: {tools}")
       
asyncio.run(main())
  1. Ensure that the MCP server located at http://127.0.0.1:8000/mcp supports oauth.
  2. Start the client.
  3. As soon as the callback server has been started, access http://localhost:1337/callback?error=<img/src/onerror=alert(window.origin)>

Note that the exploitation could also for example be initiated by a malicious authorization server by returning the exploitation URL mentioned before in the authorization_endpoint field. The client would then automatically open, causing the XSS to trigger immediatly.

Impact

The impact of this XSS vulnerability is the arbitrary JavaScript execution in the victim's browser in the callback server's origin.

Record
GHSA-mxxr-jv3v-6pgc
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weakness
CWE-79
Updated
2026-11-02
NVD 5.3

FastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0 have a reflected cross-site scripting vulnerability in the OAuth client callback page (oauth_callback.py) where unescaped user-controlled values are inserted into the generated HTML, allowing arbitrary JavaScript execution in the callback server origin. The issue is fixed in version 2.13.0.

Record
CVE-2025-62800
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV 5.3

FastMCP vulnerable to reflected XSS in client's callback page

FastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0 have a reflected cross-site scripting vulnerability in the OAuth client callback page (oauth_callback.py) where unescaped user-controlled values are inserted into the generated HTML, allowing arbitrary JavaScript execution in the callback server origin. The issue is fixed in version 2.13.0.

Record
CVE-2025-62800
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weakness
CWE-79
Updated
2026-11-02
OSVGHSA-mxxr-jv3v-6pgc 5.3

FastMCP vulnerable to reflected XSS in client's callback page

Summary

While setting up an oauth client, it was noticed that the callback page hosted by the client during the flow embeds user-controlled content without escaping or sanitizing it. This leads to a reflected Cross-Site-Scripting vulnerability.

Details

The affected code is located in https://github.com/jlowin/fastmcp/blob/main/src/fastmcp/client/oauth_callback.py, which embeds all values passed to the create_callback_html function via the message parameter it into the callback page without escaping them. This can, for example, be abused by calling the callback server with an XSS payload inside the error GET parameter, the value of which will then be inserted into the callback page, causing the execution of attacker-controlled JavaScript code in the callback server's origin. Note that besides the error parameter, other parameters reaching this function are affected too.

PoC

  1. Setup a simple fastmcp client such as this one (the callback server's port was fixated for simplicity):
url="http://127.0.0.1:8000/mcp"
oauth = OAuth(mcp_url=url,callback_port=1337)

async def main():
    async with Client(url, auth=oauth) as client:
        await client.ping()
        
        # List available operations
        tools = await client.list_tools()

        print(f"tools: {tools}")
       
asyncio.run(main())
  1. Ensure that the MCP server located at http://127.0.0.1:8000/mcp supports oauth.
  2. Start the client.
  3. As soon as the callback server has been started, access http://localhost:1337/callback?error=<img/src/onerror=alert(window.origin)>

Note that the exploitation could also for example be initiated by a malicious authorization server by returning the exploitation URL mentioned before in the authorization_endpoint field. The client would then automatically open, causing the XSS to trigger immediatly.

Impact

The impact of this XSS vulnerability is the arbitrary JavaScript execution in the victim's browser in the callback server's origin.

Record
GHSA-mxxr-jv3v-6pgc
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weakness
CWE-79
Updated
2026-11-02
OSVPYSEC-2026-1364 5.3

FastMCP vulnerable to reflected XSS in client's callback page

Summary

While setting up an oauth client, it was noticed that the callback page hosted by the client during the flow embeds user-controlled content without escaping or sanitizing it. This leads to a reflected Cross-Site-Scripting vulnerability.

Details

The affected code is located in https://github.com/jlowin/fastmcp/blob/main/src/fastmcp/client/oauth_callback.py, which embeds all values passed to the create_callback_html function via the message parameter it into the callback page without escaping them. This can, for example, be abused by calling the callback server with an XSS payload inside the error GET parameter, the value of which will then be inserted into the callback page, causing the execution of attacker-controlled JavaScript code in the callback server's origin. Note that besides the error parameter, other parameters reaching this function are affected too.

PoC

  1. Setup a simple fastmcp client such as this one (the callback server's port was fixated for simplicity):
url="http://127.0.0.1:8000/mcp"
oauth = OAuth(mcp_url=url,callback_port=1337)

async def main():
    async with Client(url, auth=oauth) as client:
        await client.ping()
        
        # List available operations
        tools = await client.list_tools()

        print(f"tools: {tools}")
       
asyncio.run(main())
  1. Ensure that the MCP server located at http://127.0.0.1:8000/mcp supports oauth.
  2. Start the client.
  3. As soon as the callback server has been started, access http://localhost:1337/callback?error=<img/src/onerror=alert(window.origin)>

Note that the exploitation could also for example be initiated by a malicious authorization server by returning the exploitation URL mentioned before in the authorization_endpoint field. The client would then automatically open, causing the XSS to trigger immediatly.

Impact

The impact of this XSS vulnerability is the arbitrary JavaScript execution in the victim's browser in the callback server's origin.

Record
PYSEC-2026-1364
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Updated
2026-11-02
OSVROOT-APP-PYPI-CVE-2025-62800 6.1

CVE-2025-62800 in rootio-fastmcp - Patched by Root

Root has patched CVE-2025-62800 in the rootio-fastmcp package for Root:PyPI. Multiple fixed versions available.

Record
ROOT-APP-PYPI-CVE-2025-62800
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
fastmcp
PyPI
 before 2.13.0
2.13.0
fastmcp
PyPI
 before 2.13.0, plus listed versions
0.1.00.2.00.3.00.3.10.3.2
Show 45 moreShow less
0.3.30.3.40.3.50.4.00.4.11.02.0.02.1.02.1.12.1.22.10.02.10.12.10.22.10.32.10.42.10.52.10.62.11.02.11.12.11.22.11.32.12.02.12.0rc12.12.12.12.22.12.32.12.42.12.52.13.0rc12.13.0rc22.13.0rc32.2.02.2.12.2.102.2.22.2.32.2.42.2.52.2.62.2.72.2.82.2.92.3.02.3.0rc12.3.1
2.13.0
rootio-fastmcp
Root:PyPI
 before 2.11.3+root.io.4
2.11.3+root.io.42.11.1+root.io.22.12.4+root.io.42.11.3+root.io.52.11.1+root.io.32.12.4+root.io.5
fastmcp
Root:PyPI
 before 2.11.3+aikido.5
2.11.3+aikido.52.11.1+aikido.32.12.4+aikido.5

History

History
WhenChangedSources
2026-11-02createdCVE List, EUVD, GitHub Advisories, NVD, OSV

References

This page doesn't list everything

Left out here: 17 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open