What is the CVSS score of CVE-2026-34460?

CVE-2026-34460 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-34460?

Yes, a patch is available for CVE-2026-34460. Update the affected software to the latest version immediately.

NamelessMC CVE-2026-34460

EUVD-2026-33960 MEDIUM

Authentication Bypass by Assumed-Immutable Data (CWE-302)

2026-06-02 GitHub_M

CSRF Nameless

5.4

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jun 02, 2026 - 17:01 EUVD

Analysis Generated

Jun 02, 2026 - 16:03 vuln.today

DescriptionCVE.org

NamelessMC is website software for Minecraft servers. In versions 2.2.4 and prior, the OAuth callback handling does not validate the state parameter server-side before exchanging the authorization code. This allows an attacker to capture a valid OAuth callback URL for their own account and cause a victim's browser to navigate to it, resulting in the victim's session being authenticated as the attacker-linked account (OAuth login CSRF / session swapping). This is patched in version 2.2.5.

AnalysisAI

OAuth login CSRF in NamelessMC 2.2.4 and prior enables session swapping by exploiting the absence of server-side state parameter validation during OAuth callback handling. An unauthenticated attacker (PR:N) who controls their own OAuth-linked account can capture a valid callback URL and socially engineer a victim (UI:R) into navigating to it, causing the victim's browser session to become authenticated as the attacker's account - effectively hijacking the victim's logged-in state. No public exploit has been identified and this is not listed in the CISA KEV catalog, but the patch to version 2.2.5 is confirmed via GitHub Security Advisory GHSA-pmpw-2xvh-5xj6.

Technical ContextAI

NamelessMC is open-source PHP-based website software designed for Minecraft server communities, offering social login via OAuth providers. The OAuth 2.0 Authorization Code flow requires that the 'state' parameter - a randomly generated CSRF token tied to the initiating session - be validated server-side when the authorization server redirects the user back to the application's callback endpoint. CWE-302 (Authentication Bypass by Capture-replay) applies here: because NamelessMC does not validate the state parameter before exchanging the authorization code for tokens, any valid callback URL can be replayed against any user's session. This breaks the binding between the OAuth initiation and the callback, collapsing the CSRF protection that state is specifically designed to provide. Affected CPE is cpe:2.3:a:namelessmc:nameless:*:*:*:*:*:*:*:* covering all versions up to and including 2.2.4.

RemediationAI

The vendor-released patch is NamelessMC version 2.2.5, confirmed by GitHub Security Advisory GHSA-pmpw-2xvh-5xj6 at https://github.com/NamelessMC/Nameless/security/advisories/GHSA-pmpw-2xvh-5xj6. Administrators should upgrade to 2.2.5 immediately. If an immediate upgrade is not operationally feasible, the most effective compensating control is to disable OAuth-based social login entirely in the NamelessMC admin panel until patching can occur - this eliminates the vulnerable code path but removes social login functionality for users, requiring them to use local accounts instead. There is no known partial mitigation that preserves OAuth login while blocking the state validation bypass.