GHSA-vqqp-x5qm-5qp4: FastMCP MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised authorization server

Summary

FastMCP's ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider (fastmcp and fastmcp-slim 4.0.0–4.1.1) lack issuer binding, so an untrusted or compromised MCP server can advertise a different authorization server and receive the client secret or a signed assertion. The flaw was introduced in 4.0.0a1; 3.x is not affected.

Mitigation

Fixed in FastMCP 4.1.2, which adds an issuer parameter to both providers and requires MCP SDK 2.2.0. Configure issuer with the identifier of the authorization server that issued the credentials, since omitting it remains supported but emits MCPDeprecationWarning. Rotate client secrets or other reusable credentials that may already have been sent to an untrusted endpoint.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• fastmcpPyPILLM dependency since 2024-11-30 · 15 tracked dependents
• fastmcp-slimPyPILLM dependency since 2026-05-11 · 4 tracked dependents

Topics

• Model Context Protocol

Related items

• MediumGHSA-2wqp-q3c6-ccj5: MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpointsSimilar attack · GitHub Advisory Database
• MediumNew Evidence Shows LiteLLM Secret-Stealing Workflows Ran 11 Days Before Supply Chain AttackSimilar attack · Socket Blog
• LowYou gave your AI agent access, but who is giving it orders?Similar attack · BleepingComputer
• MediumCritical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token BalancesSimilar attack · The Hacker News
• MediumChinese hackers spied on thousands of companies after breaching IT giant ConnectWiseSimilar attack · TechCrunch (Security)