FastMCP versions 3.0.0 through 3.4.9 and 4.0.0 through 4.1.1 contain an authorization vulnerability where direct calls to transformed components skip the final authorization check. This allows low-privilege users to invoke protected tools, resources, templates, or prompts that should be denied by policy. The issue arises because transforms modify component metadata but the authorization check is performed on the original component, not the transformed one. Fixes are available in FastMCP versions 3.4.10 and 4.1.2. Until patched, users should avoid overlapping proxy templates for protected resources and enforce authorization at the handler or server boundary.
Authlib versions prior to 0.23.1_2 contain a critical signature verification bypass vulnerability in the JsonWebSignature.deserialize_json() method. This flaw allows an attacker to submit a JSON Web Signature (JWS) object with an empty signatures array, which is incorrectly accepted as valid without any cryptographic verification. As a result, attacker-crafted payloads can be accepted as authenticated, leading to a complete authentication bypass. The issue is fixed in version 0.23.1_2.
The Model Context Protocol (MCP) Python SDK client versions 1.10.0 through 1.29.1 and 2.0.0 through 2.1.1 have a vulnerability where the client fetches server-chosen $ref URLs during tool output schema validation. This causes the client to synchronously request external HTTP, HTTPS, or local file URLs on every tool call, potentially stalling the client if the target is unresponsive. The issue is fixed in versions 1.30.0 and 2.2.0 or later by restricting reference resolution to within the schema document only.
The Model Context Protocol (MCP) Python SDK versions 1.8.0 through 1.29.1 and 2.0.0 through 2.1.1 improperly followed HTTP redirects across origins while carrying custom headers and, on certain redirects, the request body. This behavior could expose sensitive headers such as API keys to unintended hosts if the trusted endpoint redirects to a different origin. The SDK's OAuth client providers were similarly affected. The issue is fixed in MCP versions 1.30.0 and 2.2.0, which restrict redirects to the same origin or scheme upgrades on the same host. No code changes are needed to apply the fix.
Authlib's RFC 9101 (JAR) extension contains an SSRF vulnerability due to unvalidated use of the attacker-controlled request_uri parameter in a pre-authentication context. The extension forwards the request_uri to a fetch hook without enforcing the existing allowlist or other recommended controls, enabling unauthenticated SSRF. This affects versions from 0.11.11 up to but not including 0.23.1_2. A fix is available in version 0.23.1_2.
Authlib's OpenID Connect implicit grant implementation contains a vulnerability where the raw scope parameter from the client request is checked instead of the filtered allowed scope before issuing ID tokens. This allows a registered OAuth client that is not permitted the 'openid' scope but allowed other scopes like 'profile' to obtain signed ID tokens if the user consents. The issue affects deployments using the OpenID implicit grant and clients permitted 'id_token' response types but excluded from the 'openid' scope. The vulnerability does not affect authorization code flow deployments or setups where clients allowed 'id_token' response types are also allowed the 'openid' scope.
Authlib's default implementation of the RFC 7523 JWT bearer grant does not properly validate the 'aud' (audience) claim in JWT assertions. Instead of verifying that the 'aud' claim matches the authorization server's token endpoint, it only checks for the presence of the claim. This allows an attacker with a valid JWT for one audience to use it to obtain access tokens from a different authorization server sharing the same signing key, effectively bypassing audience restrictions.
Authlib versions prior to 0.23.1_2 contain a vulnerability in the OpenID ID token parsing logic where the nonce validation can be bypassed if the ID token includes a nonce_supported claim set to boolean false. This causes the nonce check to be skipped, allowing replay of a valid signed ID token into an attacker-controlled session, authenticating the attacker as the victim. The issue affects implicit and hybrid flows and direct calls to parse_id_token(), but not the authorization code flow. A fix is available in version 0.23.1_2.
Authlib versions up to 1.7.2 accept an empty HMAC key for JWS/JWT HS256/HS384/HS512 signature verification, allowing attackers to forge tokens that pass signature checks. This occurs because empty keys produce deterministic digests that anyone can reproduce, enabling token forgery and authentication bypass in OAuth 2.0 and OIDC implementations using Authlib. The vulnerability is confirmed in the v1.7.2 release and remains in the current main branch. A fix is available in version 0.23.1_2.
A vulnerability in the Authlib library (CVE-2026-114615) allows an attacker to forge HMAC signatures by exploiting an incomplete fix for algorithm confusion. The issue arises because the check preventing asymmetric public keys from being used as HMAC secrets only inspects the start of the key bytes. If the PEM public key or X.509 certificate includes a leading byte such as a newline, space, or UTF-8 BOM before the '-----BEGIN' marker, the check is bypassed, allowing an attacker with only the public key to create a valid HS256 token with arbitrary claims. This flaw affects versions >=0.11.11 and <0.23.1_2 of the mcp-atlassian Authlib package and has been fixed in version 0.23.1_2.
Authlib versions from 0.13 through 1.7.2 contain a vulnerability in the is_secure_transport() function where the loopback exemption for HTTP URLs can be bypassed by including a userinfo component in the URL. This causes the function to incorrectly treat certain cleartext HTTP URLs with non-loopback hosts as secure, violating OAuth 2.0 / OIDC TLS requirements. The flaw affects validation of redirect URIs and authorization server metadata endpoints, potentially allowing an attacker to register or use insecure URLs that bypass TLS enforcement. The severity is low and a fix is available in version 0.23.1_1.
A vulnerability in dnspython's dns.name.from_wire_parser() function can cause excessive CPU usage when processing maliciously crafted DNS messages. This can degrade application performance or lead to denial of service (DoS) in applications that handle untrusted DNS wire format messages. The issue is fixed in dnspython version 0.23.1_2. No workarounds are currently known.
A vulnerability in the OpenTelemetry Python package (opentelemetry-api) affects the TraceState.from_header method, which parses the W3C tracestate header. The parsing uses a regular expression with an unbounded optional whitespace run and no length limit, causing an O(N²) CPU cost on inputs with long runs of spaces or tabs without commas. This can lead to significant CPU consumption and blocking of request handling, especially under asyncio servers. The issue has been confirmed in versions from 1.0.0 through v1.45.0 and is fixed in version 0.23.1_2.
A Regular Expression Denial of Service (ReDoS) vulnerability exists in soupsieve's CSS selector parsing due to a quadratic-time regex backtracking issue in the IDENTIFIER and VALUE sub-patterns. This flaw can cause the interpreter to stall for seconds or minutes when processing crafted selectors with long identifier or attribute value runs that fail to match. The vulnerability is exploitable when user-controlled selectors are passed to soupsieve or BeautifulSoup's select methods. It affects soupsieve versions from 0.11.9 up to but not including 0.23.1. A fix is available in version 0.23.1.
A Regular Expression Denial of Service (ReDoS) vulnerability exists in soupsieve's whitespace/comment trimming regex RE_WS_END. The regex is used to trim trailing whitespace/comments from CSS selectors but is unanchored at the start, causing quadratic time complexity (O(n²)) when processing long runs of whitespace or comments not exactly at the string end. This can cause significant CPU delays when compiling valid selectors with large whitespace gaps. The issue affects soupsieve versions from 0.11.9 up to but not including 0.23.1 and is fixed in version 0.23.1.
pymdown-extensions versions from 0.11.9 up to but not including 0.22.0 contain a Regular Expression Denial of Service (ReDoS) vulnerability in four inline processors: caret, tilde, betterem, and magiclink. These processors use regular expressions with exponential backtracking, which can cause markdown rendering to consume unbounded CPU time when processing crafted untrusted Markdown input under 50 bytes. The issue affects the default configuration and is exploitable via the documented public API. A fix is available in version 0.22.0.
The pymdownx.b64 extension for Markdown inlines images as base64 data URIs by reading files from a configured base_path. Due to insufficient path validation, it allows a path traversal attack where an attacker can specify a src path with '../' sequences or absolute paths to read files outside the base_path if they have allowed image extensions. This leads to disclosure of file contents in the rendered output. The vulnerability affects versions from 0.11.9 up to but not including 0.22.0 and has been fixed in version 0.22.0.
The pydantic-settings library's NestedSecretsSettingsSource component improperly follows symbolic links inside a configured secrets directory that point outside this directory, allowing local files outside the intended secrets directory to be read into application settings. This behavior also bypasses the configured maximum size limit for secrets loading, potentially leading to resource exhaustion. The vulnerability requires the ability to place symlinks inside the secrets directory and is not remotely exploitable by itself. It affects versions from 0.11.10 up to but not including 0.21.1_9. A fix is available in version 0.21.1_9.
Starlette's request.form() method does not enforce configured limits on the number and size of fields for application/x-www-form-urlencoded content types, unlike multipart/form-data. This allows unauthenticated attackers to send requests with an arbitrarily large number of fields or very large fields, causing denial of service by blocking the event loop or exhausting memory. The vulnerability affects versions from 0.11.9 up to but not including 0.21.1_8. A patched version 0.21.1_8 is available that enforces these limits properly.
Starlette versions from 0.11.9 up to but not including 0.21.1_8 have a vulnerability where the HTTP request path is not validated before reconstructing request.url. This allows a specially crafted path not starting with '/' to poison the URL authority, causing request.url.hostname to be attacker-controlled. This can mislead code relying on request.url.hostname for security decisions. The issue mainly affects middleware or 404/exception handlers that read request.url before routing. A patched version 0.21.1_8 is available that prevents this behavior.