{"action":"Upgrade fastmcp to 2.13.0 or later.","affected":[{"fixed":"2.13.0","introduced":"0"}],"component":"fastmcp","cve_ids":[],"ecosystem":"PyPI","exploited":false,"fixed_versions":["2.13.0"],"ghsa_id":"GHSA-c2jp-c369-7pvx","id":"tcs_01M5KFBYQPVR0MF72HVMJXGZJX","modified_at":"2026-02-03T03:11:14.390341Z","published_at":"2025-10-29T15:38:07Z","references":["https://osv.dev/vulnerability/GHSA-c2jp-c369-7pvx","https://github.com/jlowin/fastmcp/security/advisories/GHSA-c2jp-c369-7pvx","https://github.com/jlowin/fastmcp"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-c2jp-c369-7pvx","url":"https://osv.dev/vulnerability/GHSA-c2jp-c369-7pvx"}],"summary":"FastMCP Auth Integration Allows for Confused Deputy Account Takeover"}