---
id: CVE-2025-69196
title: FastMCP is the standard framework for building MCP applications
summary: >-
  FastMCP is the standard framework for building MCP applications. Prior to
  version 2.14.2, the server does not properly respect the resource parameter
  submitted by the client in the authorization and token request. Instead of
  issuing the …
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'
cwe:
  - CWE-863
  - CWE-1220
vendor: jlowin
product: fastmcp
affected:
  - fastmcp < 2.14.2
patched:
  - fastmcp 2.14.2
published: '2026-03-16'
updated: '2026-07-08'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-69196'
references:
  - url: >-
      https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-5h2m-4q8j-pqpj
    label: security-advisories@github.com
  - url: 'https://access.redhat.com/errata/RHSA-2026:36350'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/security/cve/CVE-2025-69196'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2448179'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69196.json
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
tags:
  - nvd
epss: 0.00358
epssPercentile: 0.26881
ingestedAt: '2026-07-08T13:51:10.429Z'
---

## Overview

FastMCP is the standard framework for building MCP applications. Prior to version 2.14.2, the server does not properly respect the resource parameter submitted by the client in the authorization and token request. Instead of issuing the token explicitly for the MCP server, the token is issued for the base_url passed to the OAuthProxy during initialization. This issue has been patched 2.14.2.

## Affected

- `fastmcp < 2.14.2`

## Remediation

Upgrade past the affected range:

- `fastmcp 2.14.2`