{"cve":"CVE-2025-69196","nvd":{"published":"2026-03-16T19:16:14.397","modified":"2026-07-15T02:17:50.563","status":"Modified","description":"FastMCP is the standard framework for building MCP applications. Prior to version 2.14.2, the server does not properly respect the resource parameter submitted by the client in the authorization and token request. Instead of issuing the token explicitly for the MCP server, the token is issued for the base_url passed to the OAuthProxy during initialization. This issue has been patched 2.14.2.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","score":7.4},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","score":6.5},"cwes":["CWE-863","CWE-1220"],"references":["https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-5h2m-4q8j-pqpj","https://access.redhat.com/errata/RHSA-2026:36350","https://access.redhat.com/security/cve/CVE-2025-69196","https://bugzilla.redhat.com/show_bug.cgi?id=2448179","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69196.json"],"products":["jlowin:fastmcp"],"source":"nvd","synced_at":"2026-10-19T22:26:19.218427112+00:00"},"epss":{"cve":"CVE-2025-69196","score":0.00372,"percentile":0.31136,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-5h2m-4q8j-pqpj","url":"https://osv.dev/vulnerability/GHSA-5h2m-4q8j-pqpj","summary":"FastMCP OAuth Proxy token reuse across MCP servers","modified":"2026-07-13T16:43:46.045162193Z","packages":[{"ecosystem":"PyPI","name":"fastmcp","purl":"pkg:pypi/fastmcp","ranges":["<2.14.2"],"fixed":["2.14.2"]}]},{"id":"PYSEC-2026-2474","url":"https://osv.dev/vulnerability/PYSEC-2026-2474","summary":"FastMCP OAuth Proxy token reuse across MCP servers","modified":"2026-07-13T16:31:55.163878658Z","packages":[{"ecosystem":"PyPI","name":"fastmcp","purl":"pkg:pypi/fastmcp","ranges":["<2.14.2"],"fixed":["2.14.2"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}