CVE-2025-69196
FastMCP OAuth Proxy token reuse across MCP servers
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
FastMCP is the standard framework for building MCP applications. Prior to version 2.14.2, the server does not properly respect the resource parameter submitted by the client in the authorization and token request. Instead of issuing the token explicitly for the MCP server, the token is issued for the base_url passed to the OAuthProxy during initialization. This issue has been patched 2.14.2.
| CWE | CWE-863 |
| Vendor | jlowin |
| Product | fastmcp |
| Published | Mar 16, 2026 |
| Last Updated | Mar 16, 2026 |
Stay Ahead of the Next One
Get instant alerts for jlowin fastmcp
Be the first to know when new unknown vulnerabilities affecting jlowin fastmcp are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
jlowin / fastmcp
< 2.14.2