CVE-2026-27124

Description

FastMCP is the standard framework for building MCP applications. Prior to version 3.2.0, while testing the GitHubProvider OAuth integration, which allows authentication to a FastMCP MCP server via a FastMCP OAuthProxy using GitHub OAuth, it was discovered that the FastMCP OAuthProxy does not properly validate the users consent upon receiving the authorization code from GitHub. In combination with GitHubs behavior of skipping the consent page for previously authorized clients, this introduces a Confused Deputy vulnerability. This issue has been patched in version 3.2.0.

Risk Information

Base Score

6.5

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

EPSS Score

Exploitation Probability

0.05

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2025-64340,CVE-2026-27124,CVE-2026-32871 are fixed in Python-fastmcp 3.2.0	Windows
Vulnerabilities CVE-2025-64340,CVE-2026-27124,CVE-2026-32871 are fixed in Python-fastmcp for linux 3.2.0	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234