@fastify/oauth2 CVE-2026-18165

Exploitation requires the attacker to control a subdomain sharing the same registrable domain as the target application (e.g., attacker controls evil.example.com to target app.example.com), which is the precondition enabling cross-subdomain cookie injection. The victim must be lured through an OAuth 2.0 authorization code flow handled by the affected plugin - either by following a crafted link or being silently redirected. The vulnerability is present in default plugin configurations in versions 7.2.0-8.2.x; the hostPrefixedCookies fix is opt-in and inactive by default even after upgrade to 8.3.0 unless explicitly configured. Exploitation is strictly limited to login CSRF: the victim's own account credentials, OAuth tokens, and account data are not exposed - only the victim's active session becomes bound to the attacker's identity. Deployments where all subdomains under the registrable domain are fully trusted and organizationally controlled are not realistically exploitable.

The CVSS 4.2 score with AC:H and UI:R accurately reflects the substantial preconditions required: the attacker must possess control over a sibling subdomain on the same registrable domain as the target application, and the victim must actively participate in an OAuth authorization flow. These constraints meaningfully suppress real-world risk - opportunistic mass exploitation is not feasible, and the attack is inapplicable to deployments where the application does not share a registrable domain with untrusted or attacker-controllable subdomains. The impact is bounded by design: the vulnerability achieves login CSRF (victim is signed into the attacker's account), but does not expose the victim's own credentials, account data, or session tokens. This is a meaningful integrity and trust violation - particularly for applications where account confusion could lead to privacy leakage through the attacker observing what the victim does while logged in - but it is not a direct credential or data exfiltration path. No EPSS data was provided in the intelligence feed; exploitation probability inferred from CVSS metrics and the subdomain-control prerequisite is low. The CVE is not listed in CISA KEV and no public exploit code is referenced. SSVC assessment suggests defer or scheduled remediation priority for most deployments; accelerate only if the application is deployed alongside untrusted sibling subdomains.

An attacker who controls evil.example.com (while the target OAuth application runs at app.example.com) crafts a page that writes cookie values for state and code_verifier matching an attacker-initiated OAuth flow on the same provider. The victim is lured to visit the attacker's page, cookies are planted, and the victim is then redirected through the OAuth authorization code flow; upon callback, the @fastify/oauth2 plugin validates the planted cookies and completes the flow, binding the victim's browser session to the attacker's provider account. No public proof-of-concept code has been identified; exploitation requires attacker control of a sibling subdomain, which limits this to targeted rather than opportunistic attacks.