PyPI/fastmcp CVE-2026-27124: medium 6.1, EPSS 0.21%

FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy Vulnerabilities

Action: Upgrade fastmcp to 3.2.0 or later.

pip install fastmcp==3.2.0

Affected

Fixed versions

Sources

• osv: GHSA-rww4-4w9c-7733
• nvd: CVE-2026-27124
• https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-rww4-4w9c-7733
• https://github.com/jlowin/fastmcp/security/advisories/GHSA-rww4-4w9c-7733
• https://github.com/PrefectHQ/fastmcp

CVE-2026-27124 · published 2026-03-31T22:32:28Z · modified 2026-09-10T03:50:40.968939735Z · JSON