FastMCP CVE-2025-62800

Requires the victim to be running a FastMCP OAuth client (version < 2.13.0) with its local OAuth callback server actively listening during an in-progress authorization flow, and the victim's browser must load an attacker-controlled callback URL - either by being lured to it or, per the advisory, by a malicious/compromised authorization server returning the exploit URL in the authorization_endpoint field so the client opens it automatically. The specific trigger is an unescaped user-controlled value (notably the error GET parameter, among others passed to create_callback_html) reflected into the callback HTML. Limiting factors: exploitation depends on passive user interaction (UI:P), an active and typically localhost-bound ephemeral callback server, and the impact is confined to that callback origin rather than the MCP server or host system; no authentication is required (PR:N).

This is a genuine but moderate-severity issue, not a top-tier priority. The vendor-assigned CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P, score 5.3) describes a network-reachable, low-complexity, unauthenticated flaw that nonetheless requires passive user interaction and produces no impact on the vulnerable system itself (VC:N/VI:N/VA:N); the only impact is to a subsequent system (SC:L/SI:L) - the browser rendering the local callback page. This is consistent with a classic reflected XSS (CWE-79). Exploitation signals are mixed-to-low: EPSS is only 0.28% (18th percentile), indicating low predicted real-world exploitation volume, and the CVE is NOT in CISA KEV, so there is no evidence of active exploitation. However, publicly available exploit code (a concrete PoC in the GitHub Security Advisory) does exist, which raises practical accessibility for an attacker. The key limiting factor the raw vector understates is the attack surface: the vulnerable callback server is an ephemeral, typically localhost-bound listener that is only running during an active OAuth client flow, which sharply narrows the realistic window and targeting. Net: real and worth patching, but behaviorally closer to a targeted/opportunistic developer-workstation risk than a widespread remotely-exploitable server flaw.

A developer runs a FastMCP OAuth client, which spins up a local callback server during the authorization flow. An attacker (or a malicious/compromised authorization server that controls the redirect) induces the victim's browser to load the callback URL with an XSS payload in the error parameter (e.g. ?error=<img/src/onerror=...>), and the unescaped value executes arbitrary JavaScript in the callback server's origin. A working PoC is published in the GHSA advisory, demonstrating alert(window.origin) via the crafted callback request.