Threats tagged 'brew-fastmcp-ghsa-c2jp-c369-7pvx'

FastMCP's authentication integration with Entra ID allows the MCP server to act both as an OAuth client and authorization server. Due to Entra ID's lack of Dynamic Client Registration support, the FastMCP server uses a static app registration for authorization. After a user consents to this static client, Entra ID sets a persistent authorization cookie. An attacker controlling their own MCP client can exploit this by initiating authorization flows that reuse the victim's consented static client ID, potentially leading to confused deputy account takeover.

FastMCP's authentication integration with Entra ID allows the FastMCP server to act both as an OAuth client to Entra ID and as an authorization server to MCP clients. Due to Entra ID's lack of Dynamic Client Registration support, FastMCP uses a static app registration for authorization. After a user consents to this static client, Entra ID sets a cookie to remember the authorization state. An attacker controlling their own MCP client can exploit this by initiating authorization flows that reuse the victim's consented static client ID, potentially leading to confused deputy account takeover. This vulnerability affects FastMCP versions from 2.12.3 up to but not including 2.13.0 and has a CVSS 4.0 score of 7.3 (high severity). A fix is available in version 2.13.0.