FastMCP's MCP client wrapper lacks issuer binding, so client secrets can be sent to an attacker-declared authorization server

FastMCP fixed in 4.1.2 a vulnerability where the M2M OAuth client wrapper lacked issuer binding; affected fastmcp and fastmcp-slim versions are 4.0.0a1 to versions before 4.1.2. The root cause is that ClientCredentialsOAuthProvider and PrivateKeyJWTOAuthProvider neither accept nor forward the issuer parameter, so an untrusted or compromised MCP server can declare its own authorization server, obtain the client secret or signed assertion and impersonate the client, while the signing key itself remains local. 4.1.2 adds an issuer parameter to these two providers and requires MCP SDK 2.2.0, and also discards refresh credentials in reloaded tokens, avoiding sending credentials before the issuer is discovered.