PyPI/fastmcp: medium 5.9
FastMCP MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised authorization server
Action: Upgrade fastmcp to 4.1.2 or later.
pip install fastmcp==4.1.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.0.0a1 | 4.1.2 | - |
Fixed versions
| 4.1.2 |
Sources
- osv: GHSA-vqqp-x5qm-5qp4
- https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-vqqp-x5qm-5qp4
- https://github.com/PrefectHQ/fastmcp/pull/5933
- https://github.com/PrefectHQ/fastmcp/commit/85df42fbf2aa631cc81e0f986718b314128e91df
- https://github.com/PrefectHQ/fastmcp
- https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2
published · modified · JSON