FastMCP is the standard framework for building MCP applications.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Mar 16, 2026 · NIST NVD

   Detected

   FastMCP is the standard framework for building MCP applications. Prior to version 2.14.2, the server does not properly respect the resource parameter submitted by the client in the authorization and token request. Instead of issuing the token explicitly for the MCP server, the token is issued for the base_url passed to the OAuthProxy during initialization. This issue has been patched 2.14.2.

2. Jul 15, 2026 · NIST NVD

   Updated

   FastMCP is the standard framework for building MCP applications. Prior to version 2.14.2, the server does not properly respect the resource parameter submitted by the client in the authorization and token request. Instead of issuing the token explicitly for the MCP server, the token is issued for the base_url passed to the OAuthProxy during initialization. This issue has been patched 2.14.2.

Affected

• cpe jlowin/fastmcpversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2025-69196

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2025-69196

  FastMCP is the standard framework for building MCP applications. Prior to version 2.14.2, the server does not properly respect the resource parameter submitted by the client in the authorization and token request. Instead of issuing the token explicitly for the MCP server, the to

  nvd.nist.gov

References

• Reference · access.redhat.com
• Reference · access.redhat.com
• Reference · bugzilla.redhat.com
• Exploit · github.com
• Reference · security.access.redhat.com