CVE-2026-116672 affects Fastmcp's implementation of the OAuth 2.0 Dynamic Client Registration Management Protocol (RFC 7592) in Authlib. The provided example code for the ClientConfigurationEndpoint omits a critical security check that binds the registration_access_token to the specific client being accessed. This omission allows an attacker possessing any valid registration_access_token and knowledge of a client_id to bypass authorization and access or modify other clients' registrations. The vulnerability exists in Fastmcp versions >=2.12.3 and <4.1.1 and is fixed in version 4.1.1.