# FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy Vulnerabilities

FastMCP OAuthProxy callback never verifies the browser consented, so a captured GitHub auth URL replayed to a logged-in victim yields a valid code for the attacker's client.

- Payout: Research
- Severity: high
- Program: FastMCP
- Found by: an7y
- Disclosed: 2026-03-31
- CVE: CVE-2026-27124
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-rww4-4w9c-7733
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-rww4-4w9c-7733
- Tags: area:web domain:api domain:web impact:ato impact:internal-access kind:research platform:ghsa sev:high tech:oauth technique:source-review vuln:access-control vuln:auth-bypass

**Target:** OAuth proxy IdP callback endpoint (OAuthProxy._handle_idp_callback) with GitHubProvider
**Root cause:** The OAuthProxy IdP callback handler accepts any valid state/code pair without verifying that the browser submitting it is the same one that just granted consent, so a pre-authorized IdP session (GitHub skipping consent) lets an attacker-supplied auth URL be redeemed in the victim's browser.
**Steps:**
1. Set up an MCP server using the GitHubProvider integration and connect a benign MCP client.
2. As attacker, connect a new malicious MCP client to the same MCP server.
3. Intercept traffic (e.g. Burp); confirm the consent prompt and forward up to the GitHub authorization request.
4. Copy the GitHub authorization URL and drop the intercepted request.
5. Open that captured URL in a browser where the victim is logged into GitHub and previously authorized the client.
6. GitHub skips consent and redirects to the OAuthProxy callback, which forwards a valid code to the malicious client's callback URL.
7. Attacker exchanges the code for an access token to the benign MCP server as the victim.
**How found:** While testing the GitHubProvider OAuth integration, noticed GitHub skips consent for previously authorized clients; then read OAuthProxy._handle_idp_callback and saw it never checks that the callback browser gave consent, only that state/code are valid.
**Exploitation:** Attacker captures the GitHub authorization URL from their own consent flow, lures a victim with an existing GitHub session and prior client authorization to open it; the proxy callback issues a code to the attacker's callback URL, which the attacker exchanges for an access token to the victim's MCP server account.
**Insight:** In OAuth proxy/broker designs, the IdP callback must bind consent to the browser (consent cookie); if the IdP skips consent for returning clients, any captured authorize URL becomes a code-delivery primitive to the attacker's redirect_uri.