CVE-2025-69196: 
Homebrew vulnerability analysis and mitigation

CVE-2025-69196 is an improper resource handling vulnerability in the FastMCP OAuth Proxy that enables OAuth token reuse across MCP (Model Context Protocol) servers. The flaw causes the proxy to issue tokens scoped to the base_url passed during initialization rather than to the specific MCP server resource requested by the client, making it impossible for receiving servers to verify token legitimacy. It affects all versions of FastMCP (pip package fastmcp) prior to 2.14.2, and was disclosed on March 15, 2026. IBM Cloud Pak for AIOps is also listed as an affected product. The vulnerability carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 7.4 (High) (GitHub Advisory, FastMCP Advisory).

The root cause is classified as CWE-863 (Incorrect Authorization) and CWE-1220 (Insufficient Granularity of Access Control). In oauth_proxy.py (line ~828), the JWTIssuer is initialized with the proxy's base_url as both the issuer and audience, ignoring the resource parameter submitted by the client in authorization and token requests. As a result, issued JWT access and refresh tokens contain no resource-specific binding, violating the MCP specification's requirement to use the Resource Indicators OAuth extension (RFC 8707) for audience restriction. An attacker can exploit this by standing up a malicious MCP server that advertises the legitimate OAuth Proxy's authorization server as its own; when a victim completes the OAuth flow against the malicious server, the attacker captures the issued token and replays it against any benign MCP server sharing the same authorization server (FastMCP Advisory, GitHub Advisory).

Successful exploitation allows an unauthenticated attacker (with required victim interaction) to steal a victim's OAuth access and refresh tokens and replay them against legitimate FastMCP-based MCP servers that share the same authorization server. This results in unauthorized access to all tools and resources exposed by those benign MCP servers, representing a high confidentiality and integrity impact. Availability is not directly affected, but the attacker gains the ability to act on behalf of the victim across any MCP server in the same OAuth trust domain (FastMCP Advisory, GitHub Advisory).

A proof-of-concept (PoC) exploit with a concrete 7-step reproduction sequence — including specific scripts (mcp-server-proxy.py, mal_auth_server.py, attacker_server.py, client.py) — is publicly documented in the GitHub Security Advisory. The PoC demonstrates that a stolen token successfully returns HTTP 200 when replayed against a benign MCP server. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.013% (very low probability of exploitation in the next 30 days), and the vulnerability is not listed in the CISA KEV catalog (FastMCP Advisory, GitHub Advisory).

1. Reconnaissance: Identify a target deployment running FastMCP (versions < 2.14.2) with the OAuth Proxy enabled, using a shared authorization server (e.g., GitHubProvider).
2. Set up malicious authorization server: Deploy mal_auth_server.py — a rogue OAuth authorization server that mimics the legitimate one and is advertised by the attacker's MCP server.
3. Deploy malicious MCP server: Launch attacker_server.py, a malicious MCP server configured to advertise the benign OAuth Proxy's authorization server as its own, luring victims into completing an OAuth flow against it.
4. Lure victim: Social-engineer or redirect the victim to connect their MCP client (client.py) to the malicious MCP server instead of the legitimate one.
5. Capture token: When the victim completes the OAuth flow, the malicious MCP server receives the access token issued by the shared authorization server. Because the token lacks resource-specific audience binding, it is valid for any MCP server using the same AS.
6. Replay token: Use the captured token to send authenticated requests to the legitimate benign MCP server, gaining full access to its tools and resources on behalf of the victim.
7. Confirm access: Observe HTTP 200 responses from the benign MCP server, confirming successful token reuse (FastMCP Advisory).

• Network: Unexpected OAuth token exchange requests originating from unknown or unrecognized MCP client IPs against the FastMCP authorization server; token replay attempts to MCP server endpoints from IP addresses not associated with the original OAuth flow.
• Logs: MCP server access logs showing successful authenticated requests (HTTP 200) from sessions where the originating OAuth flow was completed against a different MCP server or client; authorization server logs showing token issuance to clients that subsequently access multiple distinct MCP server endpoints.
• Application Behavior: OAuth tokens being accepted by MCP servers for which the token was not explicitly requested (i.e., resource parameter mismatch between token issuance and usage); multiple MCP servers accepting the same token within a short time window.

Upgrade FastMCP to version 2.14.2 or later, which patches the vulnerability by issuing tokens specifically scoped to the MCP server resource submitted in the authorization URL's resource GET parameter. After upgrading, verify that JWT tokens include a resource-specific audience claim and that MCP servers validate this claim on every request. IBM Cloud Pak for AIOps users should consult the IBM support advisory for applicable fixes. No configuration-based workaround is available for unpatched versions — upgrading is the only effective remediation (FastMCP Advisory, Red Hat Bugzilla, IBM Advisory).

The vulnerability was reported by security researcher an7y and acknowledged by the FastMCP maintainers (jlowin/PrefectHQ), who published the advisory and patch on March 15, 2026. Red Hat tracked the issue via Bugzilla with high severity, and IBM issued a downstream advisory for Cloud Pak for AIOps. No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability database aggregation (FastMCP Advisory, Red Hat Bugzilla, IBM Advisory).