Shodan
Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2026-27124

FastMCP is the standard framework for building MCP applications. Prior to version 3.2.0, while testing the GitHubProvider OAuth integration, which allows authentication to a FastMCP MCP server via a FastMCP OAuthProxy using GitHub OAuth, it was discovered that the FastMCP OAuthProxy does not properly validate the user's consent upon receiving the authorization code from GitHub. In combination with GitHub’s behavior of skipping the consent page for previously authorized clients, this introduces a Confused Deputy vulnerability. This issue has been patched in version 3.2.0.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 23.4%
CVSS Severity
CVSS v3 Score 6.1
Products affected by CVE-2026-27124
  • Jlowin » Fastmcp » Version: 0.1.0
    cpe:2.3:a:jlowin:fastmcp:0.1.0
  • Jlowin » Fastmcp » Version: 0.2.0
    cpe:2.3:a:jlowin:fastmcp:0.2.0
  • Jlowin » Fastmcp » Version: 0.3.0
    cpe:2.3:a:jlowin:fastmcp:0.3.0
  • Jlowin » Fastmcp » Version: 0.3.1
    cpe:2.3:a:jlowin:fastmcp:0.3.1
  • Jlowin » Fastmcp » Version: 0.3.2
    cpe:2.3:a:jlowin:fastmcp:0.3.2
  • Jlowin » Fastmcp » Version: 0.3.3
    cpe:2.3:a:jlowin:fastmcp:0.3.3
  • Jlowin » Fastmcp » Version: 0.3.4
    cpe:2.3:a:jlowin:fastmcp:0.3.4
  • Jlowin » Fastmcp » Version: 0.3.5
    cpe:2.3:a:jlowin:fastmcp:0.3.5
  • Jlowin » Fastmcp » Version: 0.4.0
    cpe:2.3:a:jlowin:fastmcp:0.4.0
  • Jlowin » Fastmcp » Version: 0.4.1
    cpe:2.3:a:jlowin:fastmcp:0.4.1
  • Jlowin » Fastmcp » Version: 1.0
    cpe:2.3:a:jlowin:fastmcp:1.0
  • Jlowin » Fastmcp » Version: 2.0.0
    cpe:2.3:a:jlowin:fastmcp:2.0.0
  • Jlowin » Fastmcp » Version: 2.1.0
    cpe:2.3:a:jlowin:fastmcp:2.1.0
  • Jlowin » Fastmcp » Version: 2.1.1
    cpe:2.3:a:jlowin:fastmcp:2.1.1
  • Jlowin » Fastmcp » Version: 2.1.2
    cpe:2.3:a:jlowin:fastmcp:2.1.2
  • Jlowin » Fastmcp » Version: 2.10.0
    cpe:2.3:a:jlowin:fastmcp:2.10.0
  • Jlowin » Fastmcp » Version: 2.10.1
    cpe:2.3:a:jlowin:fastmcp:2.10.1
  • Jlowin » Fastmcp » Version: 2.10.2
    cpe:2.3:a:jlowin:fastmcp:2.10.2
  • Jlowin » Fastmcp » Version: 2.10.3
    cpe:2.3:a:jlowin:fastmcp:2.10.3
  • Jlowin » Fastmcp » Version: 2.10.4
    cpe:2.3:a:jlowin:fastmcp:2.10.4
  • Jlowin » Fastmcp » Version: 2.10.5
    cpe:2.3:a:jlowin:fastmcp:2.10.5
  • Jlowin » Fastmcp » Version: 2.10.6
    cpe:2.3:a:jlowin:fastmcp:2.10.6
  • Jlowin » Fastmcp » Version: 2.11.0
    cpe:2.3:a:jlowin:fastmcp:2.11.0
  • Jlowin » Fastmcp » Version: 2.11.1
    cpe:2.3:a:jlowin:fastmcp:2.11.1
  • Jlowin » Fastmcp » Version: 2.11.2
    cpe:2.3:a:jlowin:fastmcp:2.11.2
  • Jlowin » Fastmcp » Version: 2.11.3
    cpe:2.3:a:jlowin:fastmcp:2.11.3
  • Jlowin » Fastmcp » Version: 2.12.0
    cpe:2.3:a:jlowin:fastmcp:2.12.0
  • Jlowin » Fastmcp » Version: 2.12.1
    cpe:2.3:a:jlowin:fastmcp:2.12.1
  • Jlowin » Fastmcp » Version: 2.12.2
    cpe:2.3:a:jlowin:fastmcp:2.12.2
  • Jlowin » Fastmcp » Version: 2.12.3
    cpe:2.3:a:jlowin:fastmcp:2.12.3
  • Jlowin » Fastmcp » Version: 2.12.4
    cpe:2.3:a:jlowin:fastmcp:2.12.4
  • Jlowin » Fastmcp » Version: 2.12.5
    cpe:2.3:a:jlowin:fastmcp:2.12.5
  • Jlowin » Fastmcp » Version: 2.13.0
    cpe:2.3:a:jlowin:fastmcp:2.13.0
  • Jlowin » Fastmcp » Version: 2.13.0.1
    cpe:2.3:a:jlowin:fastmcp:2.13.0.1
  • Jlowin » Fastmcp » Version: 2.13.0.2
    cpe:2.3:a:jlowin:fastmcp:2.13.0.2
  • Jlowin » Fastmcp » Version: 2.13.1
    cpe:2.3:a:jlowin:fastmcp:2.13.1
  • Jlowin » Fastmcp » Version: 2.13.2
    cpe:2.3:a:jlowin:fastmcp:2.13.2
  • Jlowin » Fastmcp » Version: 2.13.3
    cpe:2.3:a:jlowin:fastmcp:2.13.3
  • Jlowin » Fastmcp » Version: 2.14.0
    cpe:2.3:a:jlowin:fastmcp:2.14.0
  • Jlowin » Fastmcp » Version: 2.14.1
    cpe:2.3:a:jlowin:fastmcp:2.14.1
  • Jlowin » Fastmcp » Version: 2.14.2
    cpe:2.3:a:jlowin:fastmcp:2.14.2
  • Jlowin » Fastmcp » Version: 2.14.3
    cpe:2.3:a:jlowin:fastmcp:2.14.3
  • Jlowin » Fastmcp » Version: 2.14.4
    cpe:2.3:a:jlowin:fastmcp:2.14.4
  • Jlowin » Fastmcp » Version: 2.14.5
    cpe:2.3:a:jlowin:fastmcp:2.14.5
  • Jlowin » Fastmcp » Version: 2.2.0
    cpe:2.3:a:jlowin:fastmcp:2.2.0
  • Jlowin » Fastmcp » Version: 2.2.1
    cpe:2.3:a:jlowin:fastmcp:2.2.1
  • Jlowin » Fastmcp » Version: 2.2.10
    cpe:2.3:a:jlowin:fastmcp:2.2.10
  • Jlowin » Fastmcp » Version: 2.2.2
    cpe:2.3:a:jlowin:fastmcp:2.2.2
  • Jlowin » Fastmcp » Version: 2.2.3
    cpe:2.3:a:jlowin:fastmcp:2.2.3
  • Jlowin » Fastmcp » Version: 2.2.4
    cpe:2.3:a:jlowin:fastmcp:2.2.4
  • Jlowin » Fastmcp » Version: 2.2.5
    cpe:2.3:a:jlowin:fastmcp:2.2.5
  • Jlowin » Fastmcp » Version: 2.2.6
    cpe:2.3:a:jlowin:fastmcp:2.2.6
  • Jlowin » Fastmcp » Version: 2.2.7
    cpe:2.3:a:jlowin:fastmcp:2.2.7
  • Jlowin » Fastmcp » Version: 2.2.8
    cpe:2.3:a:jlowin:fastmcp:2.2.8
  • Jlowin » Fastmcp » Version: 2.2.9
    cpe:2.3:a:jlowin:fastmcp:2.2.9
  • Jlowin » Fastmcp » Version: 2.3.0
    cpe:2.3:a:jlowin:fastmcp:2.3.0
  • Jlowin » Fastmcp » Version: 2.3.1
    cpe:2.3:a:jlowin:fastmcp:2.3.1
  • Jlowin » Fastmcp » Version: 2.3.2
    cpe:2.3:a:jlowin:fastmcp:2.3.2
  • Jlowin » Fastmcp » Version: 2.3.3
    cpe:2.3:a:jlowin:fastmcp:2.3.3
  • Jlowin » Fastmcp » Version: 2.3.4
    cpe:2.3:a:jlowin:fastmcp:2.3.4
  • Jlowin » Fastmcp » Version: 2.3.5
    cpe:2.3:a:jlowin:fastmcp:2.3.5
  • Jlowin » Fastmcp » Version: 2.4.0
    cpe:2.3:a:jlowin:fastmcp:2.4.0
  • Jlowin » Fastmcp » Version: 2.5.0
    cpe:2.3:a:jlowin:fastmcp:2.5.0
  • Jlowin » Fastmcp » Version: 2.5.1
    cpe:2.3:a:jlowin:fastmcp:2.5.1
  • Jlowin » Fastmcp » Version: 2.5.2
    cpe:2.3:a:jlowin:fastmcp:2.5.2
  • Jlowin » Fastmcp » Version: 2.6.0
    cpe:2.3:a:jlowin:fastmcp:2.6.0
  • Jlowin » Fastmcp » Version: 2.6.1
    cpe:2.3:a:jlowin:fastmcp:2.6.1
  • Jlowin » Fastmcp » Version: 2.7.0
    cpe:2.3:a:jlowin:fastmcp:2.7.0
  • Jlowin » Fastmcp » Version: 2.7.1
    cpe:2.3:a:jlowin:fastmcp:2.7.1
  • Jlowin » Fastmcp » Version: 2.8.0
    cpe:2.3:a:jlowin:fastmcp:2.8.0
  • Jlowin » Fastmcp » Version: 2.8.1
    cpe:2.3:a:jlowin:fastmcp:2.8.1
  • Jlowin » Fastmcp » Version: 2.9.0
    cpe:2.3:a:jlowin:fastmcp:2.9.0
  • Jlowin » Fastmcp » Version: 2.9.1
    cpe:2.3:a:jlowin:fastmcp:2.9.1
  • Jlowin » Fastmcp » Version: 2.9.2
    cpe:2.3:a:jlowin:fastmcp:2.9.2
  • Jlowin » Fastmcp » Version: 3.0.0
    cpe:2.3:a:jlowin:fastmcp:3.0.0
  • Jlowin » Fastmcp » Version: 3.0.1
    cpe:2.3:a:jlowin:fastmcp:3.0.1
  • Jlowin » Fastmcp » Version: 3.0.2
    cpe:2.3:a:jlowin:fastmcp:3.0.2
  • Jlowin » Fastmcp » Version: 3.1.0
    cpe:2.3:a:jlowin:fastmcp:3.1.0
  • Jlowin » Fastmcp » Version: 3.1.1
    cpe:2.3:a:jlowin:fastmcp:3.1.1


Products
Pricing
Contact Us

Shodan ® - All rights reserved