GHSA-vqqp-x5qm-5qp4 - FastMCP MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised authorization server

## Maintainer assessment and remediation This report is accepted as a FastMCP credential-binding vulnerability. Affected versions of the OAuth client credentials providers do not expose the authorization-server issuer that owns pre-registered credentials. An untrusted or compromised MCP server can therefore advertise a different authorization server and receive the client secret or a signed assertion. Signing keys themselves remain local; assertion replayability depends on the assertion source and audience policy. Affected stable versions are 4.0.0–4.1.1 of `fastmcp` and `fastmcp-slim`. The wrappers were introduced in 4.0.0a1; 3.x does not include them. The 4.1.2 fix adds `issuer` to `ClientCredentialsOAuthProvider` and `PrivateKeyJWTOAuthProvider` and requires MCP SDK 2.2.0. It also discards refresh credentials from reloaded tokens: without persisted authorization-server metadata, inherited refresh could otherwise transmit credentials before issuer discovery, including when a cached token was valid at startup and expired later. Cached tokens are isolated by configured issuer, so configuring or changing the issuer acquires a new token. Valid cached access tokens for the same issuer and their expiry remain intact. **Configuration required for protection:** configure `issuer` with the issuer identifier of the authorization server that issued the credentials. Upgrading alone is insufficient: omission remains supported for compatibility and emits `MCPDeprecationWarning`. Rotate client secrets or other reusable credentials that may already have been sent to an untrusted endpoint. The fix is available in FastMCP 4.1.2. ```python from fastmcp.client.auth import ClientCredentialsOAuthProvider auth = ClientCredentialsOAuthProvider( client_id="my-client-id", client_secret="my-client-secret", issuer="https://auth.example.com", ) ``` ## Original report ### Summary fastmcp's ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider do not expose or valid