HIGH🇵🇱 Wersja polska

CVE-2026-27124

CVSS 8.2v4.0pub. 2026-04-03upd. 2026-07-24

FastMCP is the standard framework for building MCP applications. Prior to version 3.2.0, while testing the GitHubProvider OAuth integration, which allows authentication to a FastMCP MCP server via a FastMCP OAuthProxy using GitHub OAuth, it was discovered that the FastMCP OAuthProxy does not properly validate the user's consent upon receiving the authorization code from GitHub. In combination with GitHub’s behavior of skipping the consent page for previously authorized clients, this introduces a Confused Deputy vulnerability. This issue has been patched in version 3.2.0.

CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Jlowin Fastmcp

    APP
    Jlowin
    < 3.2.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2026-32871CRITICAL10.0PL ✓same product

FastMCP: path traversal i SSRF przez niekodowane parametry ścieżki URL

CVE-2025-69196HIGH7.4same product

FastMCP is the standard framework for building MCP applications. Prior to version 2.14.2, the server does not ...

CVE-2025-64340MEDIUM6.7same product

FastMCP to standardowa struktura do budowania aplikacji MCP. W wersjach przed 3.2.0 nazwy serwerów zawierające...

CVE-2025-62800MEDIUM5.3same product

FastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0 have a reflected cro...

CVE-2025-62801MEDIUM5.4same product

FastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0, a command-injection...