FastMCP, a framework for building MCP applications, was found to omit consent verification when handling OAuth callbacks from GitHub. Because GitHub suppresses the consent screen for clients that have previously been authorized, the OAuthProxy could accept an authorization code without confirming the user’s intent. This flaw creates a Confused Deputy scenario in which an attacker able to obtain a valid code may gain access to the FastMCP application without the user’s knowledge. The weakness is classified as CWE‑303 (Improper Management of Consent) and CWE‑441 (Insufficiently Verified Authorization).

Any deployment of jlowin:FastMCP older than version 3.2.0 is affected. The vulnerability exists in the standard FastMCP OAuthProxy component that forwards GitHub OAuth requests. Systems running FastMCP versions 3.1.0 through 3.1.x, and any earlier releases, lack the required consent check and thus are susceptible.

The CVSS base score of 8.2 indicates high severity with potential for unauthorized access. The EPSS score below 1% suggests a low probability that this flaw is actively exploited at present, and the vulnerability is not listed in CISA’s KEV catalog. However, the attack vector is likely remote, dependent on the web-based OAuth flow, and would be feasible if an attacker can influence the OAuth authorization code exchange. Once exploited, the attacker could impersonate a legitimate user or obtain unintended privileges within the FastMCP server.