CVE-2025-62800

FastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0 have a reflected cross-site scripting vulnerability in the OAuth client callback page (oauth_callback.py) where unescaped user-controlled values are inserted into the generated HTML, allowing arbitrary JavaScript execution in the callback server origin. The issue is fixed in version 2.13.0.

• CWE-79

• https://github.com/jlowin/fastmcp/security/advisories/GHSA-mxxr-jv3v-6pgcExploit, Third Party Advisory
• https://github.com/jlowin/fastmcp/security/advisories/GHSA-mxxr-jv3v-6pgcExploit, Third Party Advisory

Published

Oct 28, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-62795JumpServer is an open source bastion host and an operation a…7.1
• CVE-2025-62796PrivateBin is an online pastebin where the server has zero k…5.8
• CVE-2025-62797FluxCP is a web-based Control Panel for rAthena servers writ…8.6
• CVE-2025-62798Sharp is a content management framework built for Laravel as…5.4
• CVE-2025-62799Fast DDS is a C++ implementation of the DDS (Data Distributi…9.8
• CVE-2025-6280A vulnerability, which was classified as critical, was found…9.8
• CVE-2025-62801FastMCP is the standard framework for building MCP applicati…7.8
• CVE-2025-62802DNN (formerly DotNetNuke) is an open-source web content mana…4.3
• CVE-2025-62804Rejected reason: Not used
• CVE-2025-62805Rejected reason: Not used
• CVE-2025-62806Rejected reason: Not used
• CVE-2025-62807Rejected reason: Not used