FastMCP Auth Integration Allows for Confused Deputy Account Takeover

### Summary FastMCP documentation [covers the scenario](https://gofastmcp.com/integrations/azure) where it is possible to use Entra ID or other providers for authentication. In this context, because Entra ID does not support Dynamic Client Registration (DCR), the FastMCP-hosted MCP server is acting as the authorization provider, as declared in the Protected Resource Metadata (PRM) document hosted on the server. For example, on a local MCP server, it may be hosted here: ```http http://localhost:8000/.well-known/oauth-protected-resource ``` And the JSON representation of the PRM document: ```json { "resource": "http://localhost:8000/mcp", "authorization_servers": [ "http://localhost:8000/" ], "scopes_supported": [ "User.Read", "email", "openid", "profile" ], "bearer_methods_supported": [ "header" ] } ``` Notice that the `authorization_servers` field contains the MCP server itself - it acts as an **OAuth Client** to the downstream authorization server (e.g., Entra ID) and as a **Authorization Server** (AS) to the MCP client. The FastMCP server also hosts the AS metadata: ```bash http://localhost:8000/.well-known/oauth-authorization-server ``` With the following content: ```json { "issuer": "http://localhost:8000/", "authorization_endpoint": "http://localhost:8000/authorize", "token_endpoint": "http://localhost:8000/token", "registration_endpoint": "http://localhost:8000/register", "scopes_supported": [ "User.Read", "email", "openid", "profile" ], "response_types_supported": [ "code" ], "grant_types_supported": [ "authorization_code", "refresh_token" ], "token_endpoint_auth_methods_supported": [ "client_secret_post" ], "code_challenge_methods_supported": [ "S256" ] } ``` All of this confirms that the FastMCP server is, in fact, handling the client-to-server authorization and then delegating the downstream effects (i.e., authorization with Entra ID) to its own redirect logic, with a call like this (as seen through MCP Inspector): ```http http://localhost:8000/authorize?response_type=code&client_id=fdec0bb8-3423-40d0-aa2a-73de26bf6f93&code_challenge=2a9ZxAEr5NEsKPwFWuEFA1W-kFMXc-02u6qc8aLf_g4&code_challenge_method=S256&redirect_uri=http%3A%2F%2Flocalhost%3A6274%2Foauth%2Fcallback%2Fdebug&state=9f23fd47e2b8786b502f116bdbfd6ae3d7d2801167e24fea82f608bb52312bbd&scope=User.Read+email+openid+profile&resource=http%3A%2F%2Flocalhost%3A8000%2Fmcp ``` When using the built-in FastMCP `/authorize` endpoint, and in the example above, FastMCP server configured with Entra ID, it will then redirect the user here: ```http https://login.microsoftonline.com/412e93fe-74e5-4ee6-9b67-1eeb1c79550e/oauth2/v2.0/authorize?response_type=code&client_id=7bac43f2-ca62-4148-93a5-fd5686cb16c0&redirect_uri=http%3A%2F%2Flocalhost%3A8000%2Fauth%2Fcallback&state=Tcv7bbg_v0Qi69RHbCzqR4tQHSHKPQuDDxjuo0wu5qU&scope=User.Read+email+openid+profile&code_challenge=bxICFAJDViuTTHIPUPdSXGLKbNbgPwiB-0ITXUJkjYM&code_challenge_method=S256&resource=http%3A%2F%2Flocalhost%3A8000%2Fmcp ``` >[!NOTE] >In the scenario above, the app registration in Entra ID is set up in the FastMCP server, as outlined in the PoC below. <img width="2725" height="630" alt="image" src="https://github.com/user-attachments/assets/7ea612bf-a49e-44da-bd79-236c26bb42f3" /> Notice that the client ID and redirect URIs in the `login.microsoftonline.com` call are different than the initial `/authorize` call - that's because we're now switching to using the MCP server's **static app registration** instead of the DCR client details. Completing the authorization flow here for the first time for a user would trigger the Entra ID consent flow: <img width="751" height="952" alt="image" src="https://github.com/user-attachments/assets/2cc4b7ee-c110-4623-8f86-438821f4addf" /> This consent flow is **only showed the first time the user needs to use this application**. Once the consent is set, they will nev

CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Severity from

GitHub (reviewed advisory)

Weakness

CWE-287

• github.com/jlowin/fastmcp/security/advisories/GHSA-c2jp-c369-7pvx
• github.com/jlowin/fastmcp