HedgeDoc CVE-2025-66629

Exploitation requires the target HedgeDoc instance (prior to 1.10.4) to have an affected OAuth2 social-login provider enabled - specifically Google, GitHub, GitLab, Facebook, or Dropbox - since the flaw is the missing state-parameter CSRF protection on those endpoints. It additionally requires victim interaction (CVSS UI:R): the victim must follow an attacker-supplied link or visit an attacker-controlled page to trigger the forged OAuth2 callback. Limiting factors: instances that do not use these social login providers are not affected, the attack cannot run fully automatically against a server (a human victim must act), and the impact is bounded to integrity (I:L) with no direct data disclosure or service disruption.

This is a genuine but low-to-moderate priority issue, and the available signals are consistent with that reading. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, base 4.3) describes a network-reachable, unauthenticated, low-complexity attack that nonetheless requires victim interaction and yields only a low integrity impact with no confidentiality or availability loss - a profile typical of login CSRF (CWE-352). EPSS is very low at 0.02% (5th percentile), the CVE is NOT on CISA KEV, and no public exploit was identified in the provided data, so there is no evidence of active exploitation. All signals agree: moderate CVSS, negligible exploitation probability, no KEV, no POC. The main caveat is that impact depends on how the OAuth2/social login is used in a given deployment; the CVSS I:L rating likely reflects session/account-binding manipulation rather than data theft. No conflicting signals were found in the input. This should be patched on a normal maintenance cadence rather than treated as an emergency.

An attacker crafts a malicious page or link containing a forged OAuth2 callback for a HedgeDoc instance configured with a social login provider (e.g., Google, GitHub, GitLab). When an authenticated or in-the-middle-of-login victim is lured into clicking it, the absence of a verified state parameter lets the attacker complete the OAuth flow in the victim's browser, enabling login CSRF - for example binding the victim's session to an attacker-controlled identity or forcing an unintended account linkage. No public exploit was identified at time of analysis, and success depends on the required user interaction (UI:R).