7.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-69196

CVE-2025-69196: FastMCP OAuth Proxy token reuse across MCP servers

FastMCP is the standard framework for building MCP applications. Prior to version 2.14.2, the server does not properly respect the resource parameter submitted by the client in the authorization and token request. Instead of issuing the token explicitly for the MCP server, the token is issued for the base_url passed to the OAuthProxy during initialization. This issue has been patched 2.14.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-69196

CVE-2025-69196:

7.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
fastmcp	pip	< 2.14.2	2.14.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows an attacker to reuse an OAuth token obtained for one MCP server to access another MCP server. This is possible because the access tokens were not correctly bound to the specific server (resource) they were issued for. The root cause lies in the OAuthProxy.__init__ method, which configured the JWT issuer with a generic audience claim based on the server's base_url instead of its specific resource URL. This misconfiguration is exploited through the OAuthProxy.authorize method, which, in its vulnerable state, failed to validate the resource parameter in the incoming authorization request. An attacker could therefore trick a user into authorizing with a malicious server, steal the resulting token, and use it on a legitimate server because the token's audience was not specific enough to be rejected. The patch addresses this by deferring the JWT issuer's configuration until the correct resource URL is known and by adding a strict resource validation check in the authorize method.

Vulnerable functions

fastmcp.server.auth.oauth_proxy.OAuthProxy.__init__

src/fastmcp/server/auth/oauth_proxy.py

The constructor for `OAuthProxy` incorrectly initialized the `JWTIssuer` with a hardcoded `audience` based on the `base_url`. This meant the issued JWTs were not tied to the specific MCP server resource, allowing them to be reused across different servers that shared the same base URL and authorization server. The patch removes this immediate initialization, deferring it to a later stage when the correct resource URL is known.

fastmcp.server.auth.oauth_proxy.OAuthProxy.authorize

src/fastmcp/server/auth/oauth_proxy.py

This function, which handles the initial authorization request, was vulnerable because it did not validate the `resource` parameter sent by the client. An attacker could initiate an OAuth flow and specify a different MCP server as the resource, and this function would not reject the request. The patch adds a security check to ensure the requested `resource` matches the server's actual resource URL, preventing the issuance of tokens for a mismatched target.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.