GHSA-c2jp-c369-7pvx
NoneCVSS
—
EPSS
—
Published
Oct 29, 2025
CISA due date
—
The record
FastMCP Auth Integration Allows for Confused Deputy Account Takeover
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | fastmcp | 0 | 2.13.0 |
Related vulnerabilities
- GHSA-rcfx-77hg-w2wv FastMCP updated to MCP 1.23+ due to CVE-2025-66416 Also affects fastmcp
- GHSA-rj5c-58rq-j5g5 FastMCP vulnerable to windows command injection in FastMCP Cursor installer via… Also affects fastmcp
- GHSA-mxxr-jv3v-6pgc FastMCP vulnerable to reflected XSS in client's callback page Also affects fastmcp
- CVE-2025-62800 FastMCP vulnerable to reflected XSS in client's callback page Also affects fastmcp
- CVE-2025-62801 FastMCP vulnerable to windows command injection in FastMCP Cursor installer via… Also affects fastmcp
- CVE-2026-114638 Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the… CWE-287
- CVE-2026-114639 Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass… CWE-287
- CVE-2026-112104 A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. CWE-287