FastMCP integrates with Entra ID for authentication, where the FastMCP server acts as both an OAuth client to Entra ID and an authorization server to MCP clients. Because Entra ID does not support Dynamic Client Registration, FastMCP uses a static app registration for authorization. Once a user consents to this static client, Entra ID sets a persistent browser cookie to remember authorization. An attacker with their own MCP client can initiate authorization requests that leverage the victim's consented static client, bypassing re-consent prompts and enabling a confused deputy attack that may result in account takeover.

An attacker controlling their own MCP client can exploit the persistent consent cookie set by Entra ID for the FastMCP static client. This allows the attacker to reuse the victim's authorization state to gain unauthorized access, effectively resulting in an account takeover via a confused deputy attack. The impact includes unauthorized access to user accounts and potentially sensitive data accessible through the compromised authorization.

A patch is available for this vulnerability. Users should apply the official fix provided by the FastMCP vendor to address the confused deputy issue. Until patched, review and restrict the use of static app registrations and consider additional validation of authorization requests to prevent reuse of consented authorization states across different MCP clients.