Medium (AgentArmorHQ estimate)Supply chainOctober 23, 2026

FastMCP M2M OAuth providers did not bind credentials to an issuer

Product: fastmcp
Affected: fastmcp 4.0.0 to 4.1.1 and fastmcp-slim 4.0.0 to 4.1.1
Fixed in: 4.1.2

Last verified against sources: October 26, 2026

Am I affected?

fastmcp: affected fastmcp 4.0.0 to 4.1.1 and fastmcp-slim 4.0.0 to 4.1.1. Fixed in 4.1.2.

Check your version: run pip show fastmcp. Versions >= 4.0.0a1, < 4.1.2 of fastmcp are affected. [1]
Check your version: run pip show fastmcp-slim. Versions >= 4.0.0a1, < 4.1.2 of fastmcp-slim are affected. [1]

What to do now

Upgrade to the fixed version: run pip install --upgrade "fastmcp>=4.1.2" (first patched version 4.1.2). [1]
Upgrade to the fixed version: run pip install --upgrade "fastmcp-slim>=4.1.2" (first patched version 4.1.2). [1]
Upgrade to FastMCP 4.1.2. [1]
Configure issuer with the issuer identifier of the authorization server that issued the credentials; upgrading alone is not enough. [1]
Rotate client secrets or other reusable credentials that may already have been sent to an untrusted endpoint. [1]

General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

Discuss this incident

What happened

FastMCP's OAuth client wrappers did not bind credentials to an issuer. [1]
An untrusted or compromised MCP server could advertise a different authorization server. [1]
The wrappers were introduced in 4.0.0a1; version 3.x does not include them. [1]

Impact

An attacker could receive the client secret or a signed assertion. [1]
The attacker could then impersonate the client against the legitimate authorization server. [1]
Signing keys stay local, and whether an assertion can be replayed depends on the assertion source and audience policy. [1]

What was done

FastMCP 4.1.2 adds an issuer setting to ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider and requires MCP SDK 2.2.0. [1]
The fix discards refresh credentials from reloaded tokens. [1]
Cached tokens are isolated by the configured issuer. [1]

Sources

GHSA-vqqp-x5qm-5qp4 — GitHub Advisory Database

Every statement above was checked against these sources before publishing. Spotted an error? Tell us and we will correct it with a dated note.

Copy a plain-text summary for Slack, GitHub issues, or team security channels.

Brief

FastMCP M2M OAuth providers did not bind credentials to an issuer
Product: fastmcp | Affected: fastmcp 4.0.0 to 4.1.1 and fastmcp-slim 4.0.0 to 4.1.1 | Fixed in: 4.1.2
Summary: FastMCP's OAuth client wrappers did not bind credentials to an issuer.
Source & remediation on AgentArmorHQ: https://agentarmorhq.com/incidents/2026/10/ghsa-vqqp-x5qm-5qp4-fastmcp

Was this page useful?

Corrections

Report an error or request a correction. We review requests within 5 business days and add a dated correction note.

Discussions for fastmcp

Ask questions or share configuration tips. Governed by our Community Rules & Terms.

No posts match this filter yet.

Be the first to ask a question or share a working tip.

← All incidents Related tools in directory Check package