CVE-2025-69196 - CVE House
Back to Database
Status published High CVE-2025-69196

FastMCP OAuth Proxy token reuse across MCP servers

Vulnerability Description

FastMCP is the standard framework for building MCP applications. Prior to version 2.14.2, the server does not properly respect the resource parameter submitted by the client in the authorization and token request. Instead of issuing the token explicitly for the MCP server, the token is issued for the base_url passed to the OAuthProxy during initialization. This issue has been patched 2.14.2.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-69196

Credits & Attribution

No credits recorded in the NVD database.

References

More from jlowin

View All →
CVE-2025-64340
FastMCP has a Command Injection vulnerability - Gemini CLI
Medium 6.7
CVE-2025-62801
FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name
Medium 5.4
CVE-2025-62800
FastMCP vulnerable to reflected XSS in client's callback page
Medium 5.3

Affected Vendor

Affected Software

fastmcp
Vulnerable Versions:
< 2.14.2

Timeline

Official Publish: March 16th, 2026
Last Modified: July 15th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-863

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1548 Abuse Elevation Control Mechanism
Privilege Escalation
T1021 Remote Services
Lateral Movement
T1098 Account Manipulation
Defense Evasion