CVE-2025-62800CWE-79cross-site-scripting

CVE-2025-62800

Medium · published October 29, 2025

CVSS v3.1

6.1

EPSS

Percentile

19.0

In the wild

Unconfirmed

What it is

FastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0 have a reflected cross-site scripting vulnerability in the OAuth client callback page (oauth_callback.py) where unescaped user-controlled values are inserted into the generated HTML, allowing arbitrary JavaScript execution in the callback server origin. The issue is fixed in version 2.13.0.

The record

Technical detail

CVSS v3.1: 6.1 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00276 · 19.0th percentile
Weakness: CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published: 2025-10-29T02:15Z

Affected products (1)

Product	Versions	Fixed in
jlowin/fastmcp	< 2.13.0	2.13.0

References (2)

https://github.com/jlowin/fastmcp/security/advisories/GHSA-mxxr-jv3v-6pgc · [email protected]https://github.com/jlowin/fastmcp/security/advisories/GHSA-mxxr-jv3v-6pgc · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

28 OCT 21:34Z
FastMCP vulnerable to reflected XSS in client's callback page
cvelistv5