CVE-2025-69196

MediumCVSS 6.5/10Last modified Jul 15, 2026

Description

FastMCP is the standard framework for building MCP applications. Prior to version 2.14.2, the server does not properly respect the resource parameter submitted by the client in the authorization and token request. Instead of issuing the token explicitly for the MCP server, the token is issued for the base_url passed to the OAuthProxy during initialization. This issue has been patched 2.14.2.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-863 CWE-1220

Affected software

No affected versions have been published.

Timeline

Published: Mar 16, 2026
Last modified: Jul 15, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-691976.5Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below allow TOTP to be used multiple times during its CVE-2025-691986.5Pterodactyl is a free, open-source game server management panel. Pterodactyl implements rate limits that are applied to the total number of CVE-2025-691996.5Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to version 1.12.0, websockets wit CVE-2025-69205.3A flaw was found in the authentication enforcement mechanism of a model inference API in ai-inference-server. All /v1/* endpoints are expect CVE-2025-692007.5phpMyFAQ is an open source FAQ web application. In versions prior to 4.0.16, an unauthenticated remote attacker can trigger generation of a CVE-2025-692019.8Tugtainer is a self-hosted app for automating updates of docker containers. In versions prior to 1.15.1, arbitary arguments can be injected CVE-2025-692026.5Axios Cache Interceptor is a cache interceptor for axios. Prior to version 1.11.1, when a server calls an upstream service using different a CVE-2025-692038.8Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the access request system have two CVE-2025-692047.5ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, in the WriteSVGIma CVE-2025-692056.3Micro Registration Utility (µURU) is a telephone self registration utility based on asterisk. In versions up to and including commit 88db9a9 CVE-2025-692064.3Hemmelig is a messing app with with client-side encryption and self-destructing messages. Prior to version 7.3.3, a Server-Side Request Forg CVE-2025-692077.1Khoj is a self-hostable artificial intelligence app. Prior to 2.0.0-beta.23, an IDOR in the Notion OAuth callback allows an attacker to hija