fastmcp vulnerabilities (PyPI)
10 vulnerabilities.
-
fastmcpPyPI FastMCP: Post-transform component authorization is skipped on direct calls 6.8 Medium -
fastmcpPyPI FastMCP MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised authorization server 5.9 Medium -
fastmcpPyPI FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability 10.0 Critical -
fastmcpPyPI FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy Vulnerabilities 8.2 High -
fastmcpPyPI FastMCP has a Command Injection vulnerability - Gemini CLI 6.7 Medium -
fastmcpPyPI FastMCP OAuth Proxy token reuse across MCP servers 7.4 High -
fastmcpPyPI FastMCP updated to MCP 1.23+ due to CVE-2025-66416 No score -
fastmcpPyPI FastMCP Auth Integration Allows for Confused Deputy Account Takeover 7.3 High -
fastmcpPyPI FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name 5.4 Medium -
fastmcpPyPI FastMCP vulnerable to reflected XSS in client's callback page 5.3 Medium