Back to Database
Status published
Medium
CVE-2025-62800
FastMCP vulnerable to reflected XSS in client's callback page
Vulnerability Description
FastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0 have a reflected cross-site scripting vulnerability in the OAuth client callback page (oauth_callback.py) where unescaped user-controlled values are inserted into the generated HTML, allowing arbitrary JavaScript execution in the callback server origin. The issue is fixed in version 2.13.0.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-62800
Credits & Attribution
No credits recorded in the NVD database.
More from jlowin
View All →Affected Vendor
jlowin
View all reports →Affected Software
fastmcp
Vulnerable Versions:
< 2.13.0
Timeline
Official Publish:
October 28th, 2025
Last Modified:
October 29th, 2025
Added to House:
July 22nd, 2026