{"action":"Upgrade fastmcp to 4.1.2 or later.","affected":[{"fixed":"4.1.2","introduced":"4.0.0a1"}],"component":"fastmcp","cve_ids":[],"ecosystem":"PyPI","exploited":false,"fixed_versions":["4.1.2"],"ghsa_id":"GHSA-vqqp-x5qm-5qp4","id":"tcs_01M5NCGXT8DR70E7NXRZ7CCDFR","modified_at":"2026-10-23T21:45:04.917049730Z","published_at":"2026-10-23T21:31:30Z","references":["https://osv.dev/vulnerability/GHSA-vqqp-x5qm-5qp4","https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-vqqp-x5qm-5qp4","https://github.com/PrefectHQ/fastmcp/pull/5933","https://github.com/PrefectHQ/fastmcp/commit/85df42fbf2aa631cc81e0f986718b314128e91df","https://github.com/PrefectHQ/fastmcp","https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-vqqp-x5qm-5qp4","url":"https://osv.dev/vulnerability/GHSA-vqqp-x5qm-5qp4"}],"summary":"FastMCP MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised authorization server"}