Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

punkpeye/fastmcp

              main @ d679655
            

Fixes

CVEs

CRITICAL

Peak severity

75.0%

Coverage

Highlights

Auth Bypass: 3 prior fixes. Scrutinize any change in this area.

src/auth/OAuthProxy.ts: most-fixed (2 issues). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Inadequate redirect URI checks in OAuthProxy allowed open-redirect vectors and authorization code theft. Mitigations required strict path canonicalization, prefix verification, and dynamic client registration (DCR) credential generation to secure callback flows.

Auth Bypass: During stdio transport initialization, session contexts were processed without resolving and passing appropriate authentication hook parameters, allowing unauthenticated sessions to execute restricted tools.

Cryptographic Issues: The token store's cipher implementation used default authentication tag lengths during AES-256-GCM operations. Forcing an explicit 128-bit authentication tag was necessary to prevent cipher truncation and integrity manipulation.