Executive brief
FastMCP is a framework used to build Model Context Protocol (MCP) applications. A security flaw in its authentication component allows an attacker to create a malicious server that tricks users into handing over their login credentials. If successful, the attacker can use these stolen credentials to access the user's data on legitimate, secure servers.
Technical details
A vulnerability exists in the FastMCP OAuth Proxy where the server fails to properly validate the 'resource' parameter during authorization and token requests. Instead of issuing a scoped token for a specific MCP server, the system issues a generic token for the base URL. An attacker can exploit this by hosting a malicious MCP server that points to a legitimate OAuth Proxy; when a victim authenticates, the attacker can capture the resulting token and reuse it to access other legitimate MCP servers sharing the same authorization server. This violates the Resource Indicators OAuth extension specification. The issue is fixed in version 2.14.2.
Affected products
- PrefectHQ FastMCP < 2.14.2
- Red Hat Red Hat Satellite 6 6
- Red Hat Red Hat Developer Hub 1
- Red Hat Red Hat OpenShift AI (RHOAI)
Timeline
- 2026-03-15: advisory: GitHub advisory published by maintainer
- 2026-03-16: disclosed: CVE published to NVD
- 2026-03-16: patched: Fix released in version 2.14.2