Threats tagged 'brew-mcp-atlassian-cve-2025-69196'

CVE-2025-69196 is a vulnerability in the FastMCP OAuth Proxy used by MCP servers where the OAuth tokens issued do not properly bind to the specific MCP server resource. Instead, tokens are issued for a base URL, allowing an attacker running a malicious MCP server to steal tokens and access other MCP servers using the same OAuth Proxy. The issue arises because the token does not include the resource parameter, violating the OAuth specification for token audience binding. The vulnerability affects FastMCP versions >=0.11.9 and <0.12.0 and is fixed in version 0.12.0.