What’s Vulnerable › Products

jlowin fastmcp vulnerabilities

6 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Check whether your jlowin fastmcp version is affected

Latest jlowin fastmcp vulnerabilities

• CVE-2026-27124 — FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy Vulnerabilities (CVSS 6.1)
• CVE-2025-64340 — FastMCP has a Command Injection vulnerability - Gemini CLI (CVSS 7.8)
• CVE-2026-32871 — FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability (CVSS 10.0)
• CVE-2025-69196 — FastMCP OAuth Proxy token reuse across MCP servers (CVSS 6.5)
• CVE-2025-62801 — FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name (CVSS 7.8)
• CVE-2025-62800 — FastMCP vulnerable to reflected XSS in client's callback page (CVSS 6.1)