{"data":{"id":"4644df9b-543d-4b78-88d5-51f97c1959db","title":"GHSA-vqqp-x5qm-5qp4: FastMCP MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised authorization server","summary":"FastMCP's ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider (fastmcp and fastmcp-slim 4.0.0–4.1.1) lack issuer binding, so an untrusted or compromised MCP server can advertise a different authorization server and receive the client secret or a signed assertion. The flaw was introduced in 4.0.0a1; 3.x is not affected.","solution":"Fixed in FastMCP 4.1.2, which adds an issuer parameter to both providers and requires MCP SDK 2.2.0. Configure issuer with the identifier of the authorization server that issued the credentials, since omitting it remains supported but emits MCPDeprecationWarning. Rotate client secrets or other reusable credentials that may already have been sent to an untrusted endpoint.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-vqqp-x5qm-5qp4","publishedAt":"2026-10-23T21:31:30.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":["fastmcp-slim@>= 4.0.0a1, < 4.1.2 (fixed: 4.1.2)","fastmcp@>= 4.0.0a1, < 4.1.2 (fixed: 4.1.2)"],"affectedPackageNames":["fastmcp-slim","fastmcp"],"affectedPackageRefs":["pypi:fastmcp-slim","pypi:fastmcp"],"affectedVendors":[],"affectedVendorsRaw":["FastMCP","MCP SDK"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":["GHSA-vqqp-x5qm-5qp4"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-10-23T21:31:30.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":["AML.T0010"]}}