A Regular Expression Denial of Service (ReDoS) vulnerability exists in soupsieve's CSS selector parser due to catastrophic backtracking in the regex pattern that parses attribute selectors with unterminated quoted values. This flaw allows an attacker to cause CPU exhaustion by submitting specially crafted CSS selectors with unterminated quotes, leading to exponential regex backtracking and thread blocking. The attack requires only about 300 bytes of input to trigger a hang exceeding 3 seconds. This affects applications using soupsieve versions from 0.11.9 up to but not including 0.21.1_8. A fix is available in version 0.21.1_8.
A memory exhaustion vulnerability exists in soupsieve, the CSS selector engine used by Beautiful Soup 4, due to unbounded memory allocation when compiling large comma-separated selector lists. An attacker can supply a crafted CSS selector string to soupsieve.compile() or Beautiful Soup's .select()/.select_one() methods, causing the application to allocate hundreds of megabytes of heap memory from a relatively small input, leading to denial of service via memory exhaustion. This affects versions >=0.11.9 and <0.21.1_8 of soupsieve. A fix is available in version 0.21.1_8.
Starlette's HTTPEndpoint dispatches HTTP methods by lowercasing the method name and using getattr without restricting to known HTTP verbs. If an HTTPEndpoint subclass is registered without specifying allowed methods, non-standard HTTP methods can invoke internal attributes as handlers, potentially bypassing authorization. This affects Starlette versions >=0.11.9 and <0.21.1_8 and frameworks built on it like FastAPI. The vulnerability is medium severity with a CVSS score of 5.3.
A vulnerability in Starlette allows an attacker to send a malformed HTTP Host header that causes the reconstructed request.url.path to differ from the actual requested path. This discrepancy can bypass security checks in middleware or endpoints that rely on request.url.path for access control. The issue affects versions from 0.11.9 up to but not including 0.21.1_7. The vulnerability does not directly grant unauthorized access but can lead to path-based authorization bypass if the application depends on request.url.path instead of the canonical ASGI path. Mitigation involves upgrading to a fixed version or using an RFC-compliant reverse proxy to reject malformed Host headers.
A regression vulnerability in pymdownx.snippets allows a path traversal bypass when restrict_base_path is enabled. The flawed check uses a string prefix match instead of a directory boundary check, enabling reading files from sibling directories with similar path prefixes. This affects versions from 10.0.1 through 10.21.2. The vulnerability permits arbitrary file reads within the host filesystem under certain path conditions, potentially exposing sensitive files during markdown processing in build pipelines.
Starlette versions from 0.11.9 up to but not including 0.11.10 contain a vulnerability in the FileResponse component where processing of HTTP Range headers exhibits quadratic time complexity. An unauthenticated attacker can exploit this by sending a crafted Range header with many small, non-overlapping ranges, causing excessive CPU usage and denial of service on endpoints serving files. This affects any Starlette application using FileResponse or StaticFiles, as well as frameworks built on Starlette such as FastAPI when serving files. The vulnerability is fixed in version 0.11.10.
FastMCP versions prior to 2.14.0 allowed usage of MCP SDK versions earlier than 1.23, which are vulnerable to CVE-2025-66416. FastMCP itself does not directly use the affected MCP SDK components. Users should upgrade to FastMCP 2.14.0 or later to avoid exposure to this vulnerability.
FastMCP's authentication integration with Entra ID allows the MCP server to act both as an OAuth client and an authorization server. Due to Entra ID's lack of support for Dynamic Client Registration, the FastMCP server uses a static app registration for authorization. After a user consents to this static client, Entra ID sets a persistent authorization cookie. An attacker controlling their own MCP client can exploit this by initiating authorization flows that reuse the victim's consented static client ID, potentially leading to account takeover. This vulnerability affects FastMCP versions from 0.11.9 up to but not including 0.11.11 and has a CVSS 4.0 score of 7.3 (high severity). A patch is available in version 0.11.11.
The joserfc library's JWT decoding function accepts attacker-forged HMAC-signed tokens when the verification key is empty or None. This occurs because the library issues only a warning for keys shorter than 14 bytes but does not reject zero-length keys, allowing attackers to forge tokens without secret knowledge. This vulnerability affects joserfc versions up to and including 1.6.7, with no patched release available at the time of this report.
The joserfc library version 1.6.5 and earlier allow oversized RFC7797 b64=false JWS payloads to bypass the configured maximum payload size limit during deserialization. This occurs because the payload size validation is not applied to unencoded payloads as specified by RFC7797, unlike the normal base64url-encoded payloads. This flaw can lead to moderate availability or resource exhaustion risks when processing untrusted JWS tokens.
Authlib's OpenID Connect Implicit and Hybrid authorization endpoints contain an unauthenticated open redirect vulnerability. An attacker can craft an authorization request omitting the 'openid' scope, causing the server to redirect users to an attacker-controlled URL. This occurs because the scope validation error redirects using an unvalidated redirect_uri parameter. The flaw affects Authlib versions from 0.11.11 up to but not including 0.21.1_4 and has been fixed in 0.21.1_4. The vulnerability enables phishing and credential harvesting by leveraging the trusted authorization server's domain in the redirect.
Authlib's OAuth 2.0 authorization endpoint contains an open redirect vulnerability triggered by an unsupported response_type parameter combined with an attacker-controlled redirect_uri. This flaw occurs before client validation, allowing unauthenticated attackers to cause the server to redirect to arbitrary URLs. The issue affects versions prior to 0.23.0 and has been confirmed in version 1.6.6 and current HEAD code. A patch is available in version 0.23.0.
Authlib versions from 0.11.11 up to but not including 0.21.1_2 have a CSRF vulnerability in their OAuth integrations when using the cache parameter. The cache-based state management lacks CSRF protection, allowing an attacker to forge authorization requests that tie the victim to the attacker's account. This issue affects multiple integration clients, including Starlette, and is fixed in version 0.21.1_2.
FastMCP OpenAPI Provider contains a critical vulnerability in its URL construction logic that allows authenticated attackers to perform server-side request forgery (SSRF) and path traversal. The vulnerability arises because path parameters are substituted into URL templates without URL encoding, enabling attackers to inject traversal sequences like '../' to escape intended API paths. This leads to unauthorized access to internal backend endpoints with the MCP provider's authentication context.
A vulnerability in the Authlib library versions >=0.11.11 and <0.13.1 allows bypassing JWT signature verification when the token header specifies 'alg: none' with an empty signature. This flaw was introduced in versions after 1.5.2 and persists through 1.6.5, causing malicious tokens to be accepted as valid without proper signature checks. The issue can lead to authentication bypass, privilege escalation, and unauthorized access. A fix is available in version 0.13.1.
Authlib Python library versions from 0.11.11 up to but not including 0.21.0 contain a critical vulnerability in the OpenID Connect (OIDC) ID Token validation process. The internal hash verification function incorrectly returns success when encountering unsupported cryptographic algorithms, allowing attackers to bypass integrity checks on the Access Token Hash (at_hash) and Authorization Code Hash (c_hash) claims. This fail-open behavior violates OIDC and JWT specifications, enabling token substitution attacks in Hybrid or Implicit OIDC flows. The vulnerability is fixed in version 0.21.0.
A cryptographic padding oracle vulnerability exists in the Authlib Python library's implementation of the JSON Web Encryption (JWE) RSA1_5 key management algorithm. Authlib disables the Bleichenbacher mitigation implemented by the underlying cryptography library by raising a distinct exception on invalid padding, creating a reliable exception oracle. This vulnerability is active by default in Authlib versions before 0.21.0 and can be exploited via distinguishable error responses in common Python web frameworks. A fix is available in Authlib version 0.21.0.
Authlib's JWS implementation contains a JWK header injection vulnerability that allows unauthenticated attackers to forge JWT tokens that pass signature verification. When the deserialization function is called with key=None or a key resolver returns None, the library uses the attacker-controlled 'jwk' header as the verification key, violating RFC 7515. This enables attackers to bypass authentication and authorization by crafting tokens with arbitrary claims and embedding their own public key in the header.
FastMCP OAuthProxy's callback handler does not verify that the browser sending the authorization code has just given consent, enabling a Confused Deputy vulnerability. An attacker can trick a victim's browser, already authorized with GitHub, into redirecting a valid authorization code to a malicious client. This allows the attacker to obtain an access token to the benign MCP server under the victim's GitHub account. The issue affects versions >=0.11.9 and <0.23.0 and is fixed in version 0.23.0.
CVE-2025-69196 is a vulnerability in the FastMCP OAuth Proxy used by MCP servers where the OAuth tokens issued do not properly bind to the specific MCP server resource. Instead, tokens are issued for a base URL, allowing an attacker running a malicious MCP server to steal tokens and access other MCP servers using the same OAuth Proxy. The issue arises because the token does not include the resource parameter, violating the OAuth specification for token audience binding. The vulnerability affects FastMCP versions >=0.11.9 and <0.12.0 and is fixed in version 0.12.0.