@fastify/oauth2 Schwachstellen (CVE)

Für @fastify/oauth2 veröffentlichte CVE-Einträge, neueste zuerst. Folgen Sie, um bei neuen Einträgen eine E-Mail zu erhalten.

2 Ergebnisse

4.2Mittel

CVE-2026-110008 vor 27 Tagen

@fastify/oauth2 vulnerable to Login CSRF via OAuth state cookie not cleared after callback

@fastify/oauth2 @fastify/oauth2

@fastify/oauth2 is a Fastify wrapper for OAuth2 login flows. In versions 7.2.0 through 8.3.1, the state and code-verifier cookies are set without a Path attribute at a login route with two or more path segments, while the clearing step at the OAuth callback w…

4.2Mittel

CVE-2026-18165 vor 3 Monaten

@fastify/oauth2 vulnerable to Login CSRF via plantable OAuth state cookies

@fastify/oauth2 @fastify/oauth2

@fastify/oauth2 is an OAuth 2.0 plugin for Fastify. In versions from 7.2.0 up to but not including 8.3.0, the plugin validates the OAuth state, and with PKCE the code verifier, by comparing the callback query parameter against an unprefixed, predictable cooki…