---
schema_version: '1.0'
id: security-20260708-c8a727
url: https://osv.dev/vulnerability/PYSEC-2026-1364
url_hash: c8a7276da7b9cc512677e504b65393619dbd647cf65c45d2fa608aa0c764bb02
canonical_url: https://osv.dev/vulnerability/PYSEC-2026-1364
source: osv:pypa
category: security/library
category_raw: cve/library
region: null
tags:
- cve
- CVE-2025-62800
- PYSEC-2026-1364
- severity:CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
- fastmcp
- PyPI
lang: en
published_at: '2026-07-07T16:03:08Z'
fetched_at: '2026-07-08T15:37:25Z'
updated_at: '2026-07-11T06:37:45Z'
status: published
content_hash: 98b4e47bc4dafdde87fd02416a307f25f75c8ad88a74e91732ab3a5ac1103874
license_note: full
summary: FastMCP vulnerable to reflected XSS in client's callback page
summary_source: rss
summary_en: FastMCP vulnerable to reflected XSS in client's callback page
entities: []
related_auto: []
title: 'CVE-2025-62800: FastMCP vulnerable to reflected XSS in client''s callback
  page'
---

# CVE-2025-62800: FastMCP vulnerable to reflected XSS in client's callback page

## TL;DR
FastMCP vulnerable to reflected XSS in client's callback page

## Key Points
- cve / CVE-2025-62800 / PYSEC-2026-1364 / severity:CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N / fastmcp / PyPI

## Details
**Severity:** CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
**Advisory:** PYSEC-2026-1364 (CVE-2025-62800)

**Affected (your watchlist):**
- `PyPI:fastmcp` 2.11.3 → fixed in 2.13.0 [docker/docker-portal+portal]

**Details:**
### Summary
While setting up an oauth client, it was noticed that the callback page hosted by the client during the flow embeds user-controlled content without escaping or sanitizing it. This leads to a reflected Cross-Site-Scripting vulnerability.

### Details
The affected code is located in *https://github.com/jlowin/fastmcp/blob/main/src/fastmcp/client/oauth_callback.py*, which embeds all values passed to the `create_callback_html` function via the `message` parameter it into the callback page without escaping them. This can, for example, be abused by calling the callback server with an XSS payload inside the `error` GET parameter, the value of which will then be inserted into the callback page, causing the execution of attacker-controlled JavaScript code in the callback server's origin. Note that besides the `error` parameter, other parameters reaching this function are affected too.

### PoC
1. Setup a simple fastmcp client such as this one (the callback server's port was fixated for simplicity):

```
url="http://127.0.0.1:8000/mcp"
oauth = OAuth(mcp_url=url,callback_port=1337)

async def main():
    async with Client(url, auth=oauth) as client:
        await client.ping()
        
        # List available operations
        tools = await client.list_tools()

        print(f"tools: {tools}")
       
asyncio.run(main())
```

2. Ensure that the MCP server located at `http://127.0.0.1:8000/mcp` supports oauth.
3. Start the client.
4. As soon as the callback server has been started, access `http://localhost:1337/callback?error=<img/src/onerror=alert(window.origin)>`

Note that the exploitation could also for example be initiated by a malicious authorization server by returning the exploitation URL mentioned before in the `authorization_endpoint` field. The client would then automatically open, causing the XSS to trigger immediatly.

### Impact
The impact of this XSS vulnerability is the arbitrary JavaScript execution in the victim's browser in the callback server's origin.

**References:**
- https://github.com/jlowin/fastmcp/security/advisories/GHSA-mxxr-jv3v-6pgc
- https://nvd.nist.gov/vuln/detail/CVE-2025-62800
- https://github.com/jlowin/fastmcp/pull/2090
- https://github.com/jlowin/fastmcp/commit/2a20f54617a37213ed83894a8c2f0ac38a2e83a3
- https://github.com/jlowin/fastmcp
- https://pypi.org/project/fastmcp
- https://github.com/advisories/GHSA-mxxr-jv3v-6pgc

_Data: OSV.dev (upstream: pypa) — https://osv.dev/vulnerability/PYSEC-2026-1364_

## Source
元記事: [CVE-2025-62800: FastMCP vulnerable to reflected XSS in client's callback page](https://osv.dev/vulnerability/PYSEC-2026-1364) — published 2026-07-07T16:03:08Z