FastMCP GHSA-vqqp-x5qm-5qp4 OAuth issuer mismatch

Evidence record

Read the original source ↗

Claim-level citations (3)

• supportsFastMCP machine-to-machine OAuth wrappers lacked issuer binding: GHSA-vqqp-x5qm-5qp4 describes issuer-unbound M2M OAuth wrappers and a fix in FastMCP 4.1.2.

  Description; Affected versions; Patched versions

• supportsFastMCP machine-to-machine OAuth wrappers lacked issuer binding: The maintainer says a malicious MCP server can receive the client secret or signed assertion, but not necessarily the signing key; JWT replay depends on audience and source policy.

  Maintainer assessment: secret redirect, assertions and signing keys

• supportsFastMCP machine-to-machine OAuth wrappers lacked issuer binding: FastMCP and fastmcp-slim OAuth client-credential wrappers introduced in 4.0.0a1 were affected before 4.1.2; 3.x never included these wrappers.

  Affected versions; Maintainer assessment and remediation