FastMCP versions 4.0.0 through 4.1.1 have a credential-binding vulnerability in their OAuth client wrappers. These wrappers do not enforce issuer binding when connecting to MCP servers, allowing a malicious or compromised MCP server to redirect client secrets to an attacker-controlled authorization server. This can lead to client secret leakage and potential impersonation. The issue is fixed in version 4.1.2, which adds mandatory issuer configuration to the OAuth providers and requires rotating any potentially exposed credentials.