CVE-2026-27124
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
In FastMCP prior to version 3.2.0, a Confused Deputy vulnerability was found in the OAuthProxy component. During GitHub OAuth integration, the server does not properly validate user consent, which combined with GitHub skipping the consent screen enables an attack.
Risk Assessment
The risk involves potential unauthorized access to MCP resources by an attacker impersonating a legitimate user.
Recommendation
It is recommended to immediately upgrade to version 3.2.0, which contains the fix.
Other vulnerabilities in FastMCP
See all- CVE-2026-32871Critical
In FastMCP prior to version 3.2.0, the _build_url() method in the RequestDirector class lacks URL encoding of path parameters. This allows an attacker to inject ../ sequences and perform a path traversal attack, enabling access to arbitrary internal endpoints.
- CVE-2025-64340Medium
A vulnerability in FastMCP before version 3.2.0. Server names containing shell metacharacters (e.g., &) can cause command injection on Windows during installation via fastmcp install claude-code or gemini-cli.
- CVE-2025-69196Medium
In the FastMCP library before version 2.14.2, the server does not properly respect the resource parameter submitted by the client in the authorization and token request. The token is issued for the base_url passed to the OAuthProxy during initialization, not for the specific MCP server.
Original NVD description (English source)
FastMCP is the standard framework for building MCP applications. Prior to version 3.2.0, while testing the GitHubProvider OAuth integration, which allows authentication to a FastMCP MCP server via a FastMCP OAuthProxy using GitHub OAuth, it was discovered that the FastMCP OAuthProxy does not properly validate the user's consent upon receiving the authorization code from GitHub. In combination with GitHub’s behavior of skipping the consent page for previously authorized clients, this introduces a Confused Deputy vulnerability. This issue has been patched in version 3.2.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS