Vulnerability	Vulnerable Version
H Insufficiently Protected Credentials fastmcp-slim is a The dependency-slim FastMCP package. Affected versions of this package are vulnerable to Insufficiently Protected Credentials via `ClientCredentialsOAuthProvider` when no `issuer` is configured, because the client does not validate that the authorization server advertised by an MCP server matches an expected issuer. An attacker who controls an MCP server endpoint can advertise a malicious OAuth metadata URL pointing to an attacker-controlled token endpoint, causing the client to send its `client_id` and `client_secret` credentials to that endpoint. The attacker can then use the captured credentials to impersonate the client against the legitimate authorization server. Note: This is only exploitable when the `ClientCredentialsOAuthProvider` is used without an explicit `issuer` parameter configured. How to fix Insufficiently Protected Credentials? Upgrade `fastmcp-slim` to version 4.1.2 or higher.	[4.0.0a1,4.1.2)

Insufficiently Protected Credentials

fastmcp-slim is a The dependency-slim FastMCP package.

Affected versions of this package are vulnerable to Insufficiently Protected Credentials via ClientCredentialsOAuthProvider when no issuer is configured, because the client does not validate that the authorization server advertised by an MCP server matches an expected issuer. An attacker who controls an MCP server endpoint can advertise a malicious OAuth metadata URL pointing to an attacker-controlled token endpoint, causing the client to send its client_id and client_secret credentials to that endpoint. The attacker can then use the captured credentials to impersonate the client against the legitimate authorization server.

Note: This is only exploitable when the ClientCredentialsOAuthProvider is used without an explicit issuer parameter configured.

How to fix Insufficiently Protected Credentials?

Upgrade fastmcp-slim to version 4.1.2 or higher.

[4.0.0a1,4.1.2)

Go back to all versions of this package