{
  "entry": {
    "kind": "vuln",
    "slug": "ghsa-7xgj-8392-5q4r",
    "name": "GHSA-7xgj-8392-5q4r",
    "vendor": "fastmcp",
    "description": "PrefectHQ published two FastMCP advisories on 23 October 2026, both rated medium. GHSA-7xgj-8392-5q4r (CVSS 6.8): when a server transform changed the metadata a component's authorization policy reads, direct lookups checked the original component but returned the transformed one, so a client that knew the identifier could call a tool, or read a resource or prompt, that the policy denies; it affects 3.0.0 to 3.4.9 and 4.0.0 to 4.1.1. GHSA-vqqp-x5qm-5qp4 (CVSS 5.9): the client-side ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider in 4.0.0 to 4.1.1 did not bind credentials to the authorization server that issued them, so an untrusted or compromised MCP server could advertise its own authorization server and receive the client secret or a signed assertion. Upgrading alone does not fix the second: 4.1.2 adds an issuer parameter that has to be configured. Both packages, fastmcp and fastmcp-slim, are affected. This follows the critical FastMCP client code-execution fix a week earlier.",
    "website": "https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-7xgj-8392-5q4r",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": {
      "manager": "unknown",
      "packageName": "fastmcp",
      "command": null
    },
    "configFiles": null,
    "category": "mcp-server",
    "updatedAt": "2026-10-23",
    "risk": {
      "score": 68,
      "band": "medium",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "GHSA-7xgj-8392-5q4r",
      "aliases": [
        "ti-156"
      ],
      "title": "FastMCP 3.4.10 and 4.1.2: Transformed Components Skipped Their Authorization Check, and the 4.x OAuth Client Credentials Providers Could Send the Client Secret to a Server-Chosen Authorization Server",
      "summary": "PrefectHQ published two FastMCP advisories on 23 October 2026, both rated medium. GHSA-7xgj-8392-5q4r (CVSS 6.8): when a server transform changed the metadata a component's authorization policy reads, direct lookups checked the original component but returned the transformed one, so a client that knew the identifier could call a tool, or read a resource or prompt, that the policy denies; it affects 3.0.0 to 3.4.9 and 4.0.0 to 4.1.1. GHSA-vqqp-x5qm-5qp4 (CVSS 5.9): the client-side ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider in 4.0.0 to 4.1.1 did not bind credentials to the authorization server that issued them, so an untrusted or compromised MCP server could advertise its own authorization server and receive the client secret or a signed assertion. Upgrading alone does not fix the second: 4.1.2 adds an issuer parameter that has to be configured. Both packages, fastmcp and fastmcp-slim, are affected. This follows the critical FastMCP client code-execution fix a week earlier.",
      "severity": "medium",
      "cvss": {
        "score": 6.8,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Authentication bypass"
      ],
      "componentType": "mcp-server",
      "component": {
        "name": "fastmcp",
        "vendor": null,
        "package": "fastmcp",
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": ">=3.0.0 <3.4.10 || >=4.0.0 <4.1.2",
          "fixed": "3.4.10"
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-10-23",
      "modifiedAt": "2026-10-23",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "advisory",
          "url": "https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-7xgj-8392-5q4r"
        }
      ],
      "mitigation": "Upgrade fastmcp or fastmcp-slim to 3.4.10 or 4.1.2. On 4.1.2, set issuer on every ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider to the authorization server that issued the credentials, because leaving it out keeps the old behaviour with only a deprecation warning, and rotate client secrets that may have reached an MCP server you do not control. Until upgraded, enforce authorization at the handler or server boundary rather than in a policy whose inputs a transform changes, and avoid proxy templates that overlap protected resources.",
      "detectedByAnomity": true
    }
  }
}