Kimi cli: FastMCP Auth Integration Allows for Confused Deputy Account Takeover
The kimi-cli FastMCP authentication integration allows a confused deputy attack leading to account takeover. The FastMCP server acts both as an OAuth client to a downstream authorization server (e.g., Entra ID) and as an authorization server to its clients. Due to the use of a static client registration in Entra ID and persistent user consent cookies, an attacker controlling their own MCP client can leverage the victim's prior consent to the static client to bypass re-authorization prompts. This enables the attacker to obtain authorization codes and potentially take over the victim's account. A patch is available for this vulnerability.
AI Analysis
Technical Summary
FastMCP integrates with Entra ID for authentication but does not support Dynamic Client Registration (DCR). The FastMCP server acts as both an OAuth client to Entra ID and an authorization server to its own clients. The Entra ID app registration uses a static client ID and redirect URIs. After a user consents once to this static client, Entra ID sets a persistent cookie to avoid repeated consent prompts. An attacker operating their own MCP client can initiate authorization flows that reuse the victim's consented static client ID, allowing the attacker to obtain authorization codes without triggering consent prompts. This confused deputy scenario can lead to account takeover. The vulnerability affects kimi-cli versions >=0.42_1 and <1.44.0. A patch is available.
Potential Impact
An attacker controlling their own MCP client can exploit the persistent consent cookie for the static Entra ID client registration to bypass user consent prompts and obtain authorization codes. This can lead to unauthorized access and account takeover of victim users who have previously consented to the static client. The vulnerability compromises the integrity of the OAuth authorization flow in FastMCP integrations with Entra ID.
Mitigation Recommendations
A patch is available for kimi-cli versions >=0.42_1 and <1.44.0 that addresses this confused deputy vulnerability. Users should update to the fixed version to prevent exploitation. No additional mitigation steps are indicated by the vendor advisory.
Kimi cli: FastMCP Auth Integration Allows for Confused Deputy Account Takeover
Description
The kimi-cli FastMCP authentication integration allows a confused deputy attack leading to account takeover. The FastMCP server acts both as an OAuth client to a downstream authorization server (e.g., Entra ID) and as an authorization server to its clients. Due to the use of a static client registration in Entra ID and persistent user consent cookies, an attacker controlling their own MCP client can leverage the victim's prior consent to the static client to bypass re-authorization prompts. This enables the attacker to obtain authorization codes and potentially take over the victim's account. A patch is available for this vulnerability.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
FastMCP integrates with Entra ID for authentication but does not support Dynamic Client Registration (DCR). The FastMCP server acts as both an OAuth client to Entra ID and an authorization server to its own clients. The Entra ID app registration uses a static client ID and redirect URIs. After a user consents once to this static client, Entra ID sets a persistent cookie to avoid repeated consent prompts. An attacker operating their own MCP client can initiate authorization flows that reuse the victim's consented static client ID, allowing the attacker to obtain authorization codes without triggering consent prompts. This confused deputy scenario can lead to account takeover. The vulnerability affects kimi-cli versions >=0.42_1 and <1.44.0. A patch is available.
Potential Impact
An attacker controlling their own MCP client can exploit the persistent consent cookie for the static Entra ID client registration to bypass user consent prompts and obtain authorization codes. This can lead to unauthorized access and account takeover of victim users who have previously consented to the static client. The vulnerability compromises the integrity of the OAuth authorization flow in FastMCP integrations with Entra ID.
Mitigation Recommendations
A patch is available for kimi-cli versions >=0.42_1 and <1.44.0 that addresses this confused deputy vulnerability. Users should update to the fixed version to prevent exploitation. No additional mitigation steps are indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BREW-kimi-cli-GHSA-c2jp-c369-7pvx
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Homebrew"]
- Cvss Version
- 4.0
Threat ID: 6aac8e0b55bf5e2cf54903d2
Added to database: 09/18/2026, 01:04:11 UTC
Last enriched: 09/18/2026, 01:33:51 UTC
Last updated: 09/18/2026, 03:01:24 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.