CVE-2025-62800: 
Homebrew vulnerability analysis and mitigation

CVE-2025-62800 is a reflected cross-site scripting (XSS) vulnerability in FastMCP, the standard framework for building Model Context Protocol (MCP) applications. The flaw exists in the OAuth client callback page (oauth_callback.py), where unescaped user-controlled values are inserted directly into generated HTML, enabling arbitrary JavaScript execution in the callback server's origin. All versions prior to 2.13.0 are affected. It was published on October 28, 2025, with a CVSS v3.1 score of 6.1 (Medium) and a CVSS v4.0 score of 5.3 (Medium) (GitHub Advisory, FastMCP Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), classified as a reflected XSS. The vulnerable code resides in src/fastmcp/client/oauth_callback.py, where the create_callback_html function embeds values from the message parameter — including the error GET parameter and other user-supplied inputs — directly into the HTML response without HTML-escaping or sanitization. An attacker can craft a malicious URL targeting the callback server (e.g., http://localhost:1337/callback?error=<script>...</script>) to inject and execute arbitrary JavaScript in the victim's browser within the callback server's origin. Exploitation can also be triggered automatically if a malicious OAuth authorization server returns a crafted authorization_endpoint URL, causing the client to open the XSS payload without further user interaction (FastMCP Advisory, GitHub Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser within the OAuth callback server's origin. This can lead to theft of session tokens or OAuth credentials, hijacking of the authentication flow, and unauthorized actions performed on behalf of the victim. While availability is not directly impacted, the confidentiality and integrity of the subsequent system (e.g., the MCP application context) are at low-to-moderate risk (FastMCP Advisory, GitHub Advisory).

A proof-of-concept (PoC) is publicly documented in the GitHub Security Advisory, demonstrating exploitation via a crafted callback URL with an XSS payload in the error parameter. No authentication is required, though user interaction (passive) is needed for the standard attack path; however, a malicious authorization server can trigger the XSS automatically without additional user action. There is no evidence of active in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.059% (19th percentile), indicating a low near-term exploitation probability (FastMCP Advisory, GitHub Advisory).

1. Identify target: Locate a FastMCP client instance (version < 2.13.0) that is configured to use OAuth authentication and has an active callback server running (default or fixed port, e.g., 1337).
2. Craft malicious URL: Construct a callback URL with an XSS payload in the error GET parameter, e.g., http://localhost:1337/callback?error=<script>alert(document.cookie)</script>.
3. Deliver payload: Either directly access the crafted URL if the callback server is reachable, or — for a more impactful attack — operate a malicious OAuth authorization server that returns the crafted callback URL in the authorization_endpoint field of its metadata.
4. Trigger automatic execution: When the FastMCP client initiates the OAuth flow against the malicious authorization server, it automatically opens the crafted URL in the user's browser, causing the XSS payload to execute immediately without additional user interaction.
5. Achieve objective: The injected JavaScript executes in the callback server's origin, enabling session token theft, credential harvesting, or other malicious actions within that browser context (FastMCP Advisory, GitHub Advisory).

• Network: Unexpected HTTP GET requests to the FastMCP OAuth callback endpoint (e.g., /callback) containing URL-encoded HTML or JavaScript in the error or other query parameters (e.g., error=%3Cscript%3E...%3C%2Fscript%3E).
• Logs: Web server or application logs showing requests to the callback path with suspicious query string values containing <script>, javascript:, onerror=, or similar XSS indicators.
• Browser/Client: Unexpected JavaScript execution or alert dialogs appearing during the OAuth authentication flow in the FastMCP client; unusual outbound network requests from the browser during the OAuth callback phase.

The vulnerability is fixed in FastMCP version 2.13.0, which properly HTML-escapes user-controlled input in the OAuth callback page before rendering it in HTML. Users should upgrade to version 2.13.0 or later immediately. As interim mitigations, operators can implement Content Security Policy (CSP) headers to restrict script execution, and ensure that only trusted OAuth authorization servers are configured for use with FastMCP clients (FastMCP Advisory, GitHub Advisory).

The vulnerability was reported by security researcher "an7y" and disclosed responsibly through GitHub's security advisory process. The advisory was published by the FastMCP maintainer (jlowin) on October 28, 2025, and reviewed by the GitHub Advisory Database on October 29, 2025. No significant broader media coverage or notable community commentary beyond the advisory itself has been identified (FastMCP Advisory).