CVE Feed

    Dashboard / CVE / CVE-2025-69196

    CVE-2025-69196

    FastMCP is the standard framework for building MCP applications. Prior to version 2.14.2, the server does not properly respect the resource parameter submitted by the client in the authorization and token request. Instead of issuing the token explicitly for the MCP server, the token is issued for the base_url passed to the OAuthProxy during initialization. This issue has been patched 2.14.2.

    Published:Mar 16, 2026
    Last Modified:Mar 24, 2026
    EPS:Mar 16, 2026
    EPSS Score:0.00013
    CVSS Score:6.5

    Affected Products

    Vendor
    Jlowin
    Product
    Fastmcp

    Exploits

    https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-5h2m-4q8j-pqpj

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High