CVE-2026-27124: FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy Vulnerabilities

What it is

While testing the GitHubProvider OAuth integration, which allows authentication to a FastMCP MCP server via a FastMCP OAuthProxy using GitHub OAuth, it was discovered that the FastMCP OAuthProxy does not properly validate the user's consent upon receiving the authorization code from GitHub. In combination with GitHub’s behavior of skipping the consent page for previously authorized clients, this introduces a Confused Deputy vulnerability.

Technical Details An adversary can initiate an authentication flow by connecting their malicious MCP client to a benign MCP server using the GitHubProvider OAuth integration. During this flow, the attacker consents to connect their client to the MCP server and, at that point, can capture the GitHub authorization URL they are redirected to after granting consent. The attacker can then lure a victim, who is already logged into GitHub and has previously connected an MCP client to the benign MCP server, to open this captured URL.

How to check

1. Affected: fastmcp (pip) < 3.2.0.
2. Compare your installed version with the range above (command below).

How to fix

1. Upgrade fastmcp to 3.2.0 or later.

pip show fastmcp | grep Version

Sources

• GitHub Security Advisory GHSA-rww4-4w9c-7733 ↗
• NVD: CVE-2026-27124 ↗