joserfc version 3.2.4_2 up to but not including 4.1.2 has a vulnerability in its compact JWS size guard. The library calls bytes.split() on attacker-controlled input before validating size limits, causing it to allocate memory roughly equal to the payload size before rejecting oversized inputs. This can lead to increased memory usage and potential denial of service. A fix is available in version 4.1.2 that checks input length before splitting to prevent unnecessary allocations.
The joserfc library's decrypt_json() function for JWE General JSON Serialization accepts an unbounded recipients array, performing a costly RSA private-key decryption for each recipient without limit. This allows an unauthenticated attacker to cause CPU exhaustion (Denial of Service) by sending a single JWE JSON with many recipients. The library caps sizes of other JWE elements but does not limit recipient count. The documented mitigation option verify_all_recipients=False does not reduce CPU usage, as all recipients are decrypted before this flag is checked. This vulnerability is tracked as CVE-2026-119283 with a CVSS 3.1 score of 7.5 (High). A fix is available in joserfc version 4.0.0.
CVE-2026-116672 affects Fastmcp's implementation of the OAuth 2.0 Dynamic Client Registration Management Protocol (RFC 7592) in Authlib. The provided example code for the ClientConfigurationEndpoint omits a critical security check that binds the registration_access_token to the specific client being accessed. This omission allows an attacker possessing any valid registration_access_token and knowledge of a client_id to bypass authorization and access or modify other clients' registrations. The vulnerability exists in Fastmcp versions >=2.12.3 and <4.1.1 and is fixed in version 4.1.1.
FastMCP versions 4.0.0 through 4.1.1 have a credential-binding vulnerability in their OAuth client wrappers. These wrappers do not enforce issuer binding when connecting to MCP servers, allowing a malicious or compromised MCP server to redirect client secrets to an attacker-controlled authorization server. This can lead to client secret leakage and potential impersonation. The issue is fixed in version 4.1.2, which adds mandatory issuer configuration to the OAuth providers and requires rotating any potentially exposed credentials.
FastMCP versions 3.0.0 through 4.1.1 have an authorization bypass vulnerability where direct calls to transformed components skip the final authorization check. This allows low-privilege users to invoke protected tools, resources, templates, or prompts that should be denied. The issue arises because transforms are applied before authorization, but the authorization check is not re-applied to the transformed component. Fixes are available in FastMCP 3.4.10 and 4.1.2.
Authlib versions prior to 1.9.0 contain a critical signature verification bypass vulnerability in the JsonWebSignature.deserialize_json() method. This flaw allows an attacker to submit a JSON Web Signature (JWS) object with an empty signatures array, which the method incorrectly accepts as valid without verifying any signature or requiring a cryptographic key. This results in an authentication bypass where attacker-crafted payloads are accepted as legitimately signed. The vulnerability is fixed in Authlib version 4.1.1.
The Model Context Protocol (MCP) Python SDK client versions 1.10.0 through 1.29.1 and 2.0.0 through 2.1.1 have a vulnerability where the client fetches external URLs or local files referenced in a tool's output schema during validation. This can cause the client to make network or file system requests synchronously without timeout, potentially freezing the client session if the target is unresponsive. The issue affects clients calling tools on MCP servers they do not fully control. Fixed in versions 1.30.0 (1.x) and 2.2.0 (2.x) and later.
The Model Context Protocol (MCP) Python SDK versions 1.8.0 through 1.29.1 and 2.0.0 through 2.1.1 have a vulnerability where their HTTP client transports follow cross-origin HTTP redirects and send custom headers and request bodies to the redirected host. This can expose sensitive headers such as API keys if the trusted endpoint redirects to an attacker-controlled domain. The SDK now restricts redirects to the same origin or an http-to-https upgrade on the same host. Fixed in versions 1.30.0 and 2.2.0 and later.
Authlib's implementation of the RFC 9101 JWT-secured authorization request (JAR) extension contains an unvalidated request_uri parameter that is passed to a fetch hook without validation at a pre-authentication endpoint. This allows an attacker to supply arbitrary URIs that the server fetches without checking against the existing allowlist or performing recommended security controls, resulting in an unauthenticated server-side request forgery (SSRF) vulnerability. The vulnerability affects Authlib versions from 2.12.3 up to but not including 4.1.1. A fix is available in version 4.1.1.
Authlib's OpenID Connect implicit grant implementation improperly checks the raw requested scope instead of the filtered allowed scope before issuing ID tokens. This allows a registered OAuth client, which is not permitted the 'openid' scope but allowed other scopes like 'profile', to receive a signed ID token if the user consents. The ID token contains identity claims such as 'sub' and 'name', effectively bypassing the intended scope restriction. This issue affects versions from 2.12.3 up to but not including 4.1.1 and is fixed in version 4.1.1.
Authlib's default implementation of the RFC 7523 JWT bearer grant does not properly validate the audience ('aud') claim in JWT assertions. Instead of verifying that the 'aud' claim matches the authorization server's token endpoint, it only checks for the presence of the claim. This allows an attacker with a valid JWT for any audience to obtain an access token from a different authorization server sharing the same signing key. The issue affects Authlib versions from 2.12.3 up to but not including 4.1.1 and has been fixed in version 4.1.1.
Authlib versions prior to 4.1.1 contain a vulnerability where an ID token can disable nonce validation by including a nonce_supported claim set to false. This causes the relying party to skip nonce checks, allowing replay of a validly signed ID token from another session. The flaw affects implicit and hybrid OpenID Connect flows and direct calls to parse_id_token(), but not the authorization code flow. A fix is available in version 4.1.1.
Authlib versions up to 1.7.2 accept an empty HMAC key for JWS/JWT signature verification using HS256, HS384, and HS512 algorithms. This allows an attacker to forge arbitrary tokens that pass signature verification if the application verifies tokens with an empty key. The vulnerability arises because empty keys produce deterministic HMAC digests that anyone can reproduce, and Authlib does not reject zero-length keys. This flaw can lead to token forgery and authentication bypass in OAuth 2.0 resource servers and OIDC relying parties using Authlib. A fix is available in Authlib version 4.1.1.
CVE-2026-114615 is a vulnerability in the Fastmcp product affecting authlib.jose's handling of asymmetric public keys used as HMAC secrets. The key import guard that prevents misuse of asymmetric keys by checking for specific PEM header prefixes is bypassed if the PEM data has a single leading byte (e.g., newline, space, indentation, UTF-8 BOM, or comment line). This allows an attacker with only the issuer's public key to forge HS256 tokens with arbitrary claims that are accepted as authentic. The flaw is an incomplete fix of a previous vulnerability (CVE-2024-37568) and affects versions >=2.12.3 and <4.1.1. A fix is available in version 4.1.1.
Authlib's is_secure_transport() function incorrectly treats URLs with a userinfo component containing loopback prefixes as secure, allowing cleartext HTTP URLs with external hosts to bypass TLS enforcement. This affects OAuth 2.0 / OIDC endpoint and redirect URI validation, potentially allowing attackers to register or use non-TLS URLs that should be rejected. The issue is present in Authlib versions from 0.13 through 1.7.2 and fixed in version 4.0.0. The vulnerability is considered low severity due to its defense-in-depth nature and limited impact.
A vulnerability in fastmcp's use of dnspython's dns.name.from_wire_parser() can cause excessive CPU consumption when processing maliciously crafted DNS messages. This can degrade application performance or lead to denial of service (DoS). The issue is fixed in fastmcp version 4.1.1. No known workarounds exist.
The Model Context Protocol (MCP) Python SDK versions 1.10.0 through 1.29.1 and 2.0.0 through 2.1.1 have a vulnerability in server-side bearer-token authentication. The SDK does not verify that a token's audience matches the intended server, allowing tokens issued for other services by the same authorization server to be accepted. This can lead to unauthorized access if tokens meant for different services are accepted. Fixed versions 1.30.0+ and 2.2.0+ introduce a new setting to validate the token audience, but it must be explicitly enabled. Without enabling this validation or manually checking the token audience, the vulnerability remains exploitable.
FastMCP's authentication integration with Entra ID allows the FastMCP server to act both as an OAuth client to Entra ID and as an authorization server to MCP clients. Due to Entra ID's lack of Dynamic Client Registration support, FastMCP uses a static app registration for authorization. After a user consents to this static client, Entra ID sets a cookie to remember the authorization state. An attacker controlling their own MCP client can exploit this by initiating authorization flows that reuse the victim's consented static client ID, potentially leading to confused deputy account takeover. This vulnerability affects FastMCP versions from 2.12.3 up to but not including 2.13.0 and has a CVSS 4.0 score of 7.3 (high severity). A fix is available in version 2.13.0.
Starlette's request.form() method does not enforce configured limits on max_fields and max_part_size for application/x-www-form-urlencoded content types, allowing an attacker to send requests with very large numbers of fields or very large field sizes. This leads to denial of service by blocking the event loop or causing excessive memory allocation. The issue affects applications using Starlette or FastAPI that parse urlencoded form data. A patch is available that enforces these limits for urlencoded bodies.
Starlette versions from 2.12.3 up to but not including 3.4.2_1 improperly handle HTTP request paths that do not start with a slash. This allows an attacker to craft a request path that alters the reconstructed request URL's hostname, misleading code that relies on request.url.hostname for security decisions. The issue affects middleware or handlers that inspect request.url before routing, but does not affect normal routing or endpoint execution. A patch is available in version 3.4.2_1 that corrects this behavior.