Which versions of Leantime are affected by CVE-2026-59713?

Leantime's OpenID Connect authentication contains a session hijacking vulnerability (CVSS 8.6) allowing attackers to trick users into logging into attacker-controlled accounts via malicious links.. A patch is available.

How to fix or mitigate CVE-2026-59713?

Within 24 hours: Identify all Leantime instances in your environment and determine current versions. Within 7 days: Deploy the vendor-released patch to all affected Leantime systems and verify successful application. Within 30 days: Review audit logs for suspicious login activity from the exposure period and conduct access verification for potentially compromised accounts.

Leantime CVE-2026-59713

Q: What is the CVSS score of CVE-2026-59713?

CVE-2026-59713 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-41941 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-07-06 VulnCheck

GHSA-vwm8-rprj-29f7

CSRF Leantime

8.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Network-reachable OIDC callback with no attacker privileges (PR:N) but mandatory victim click (UI:R); login-CSRF yields high C/I via attacker-account session fixation and no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 06, 2026 - 21:37 vuln.today

DescriptionCVE.org

Leantime contains an OIDC login CSRF vulnerability in the verifyState() method that unconditionally returns true without validating state parameters. Attackers can craft malicious callback URLs with attacker-controlled authorization codes to perform session fixation, logging victims in as the attacker.

AnalysisAI

Login CSRF (session fixation) in Leantime's OpenID Connect authentication flow allows an attacker to authenticate a victim into an attacker-controlled account. The root cause is a stubbed verifyState() method that unconditionally returns true, so the OIDC state parameter is never validated, letting a crafted callback URL carrying an attacker-supplied authorization code complete login as the attacker. No public exploit identified at time of analysis, but a vendor patch and a public technical advisory (VulnCheck) exist; CVSS 4.0 is rated 8.6 (High).

Technical ContextAI

Leantime is an open-source project management application that supports OpenID Connect (OIDC) single sign-on. In a correct OIDC authorization-code flow, the client generates a random 'state' value before redirecting to the identity provider and verifies that the value returned on the callback matches, binding the callback to the user's own session and preventing cross-site request forgery. Here the verifyState() method is a non-functional stub that always returns true, so no comparison ever occurs. This is a textbook CWE-352 (Cross-Site Request Forgery) instance applied to the authentication callback - because the anti-CSRF token (the OIDC state) is not checked, an attacker can substitute their own authorization code and force the victim's browser to complete the login, a login-CSRF / session-fixation outcome. The affected component is identified in CPE as cpe:2.3:a:leantime:leantime across all versions prior to the fix.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the fix from commit 9630eb7db682fb1b4e23cdabf3428d03ec6f5094 (https://github.com/Leantime/leantime/commit/9630eb7db682fb1b4e23cdabf3428d03ec6f5094), which restores real validation of the OIDC state parameter, and track the tagged release referenced in issue https://github.com/Leantime/leantime/issues/3535 before upgrading production. If patching cannot be done immediately, the most effective compensating control is to disable OIDC/SSO login and fall back to local authentication, which fully removes the vulnerable code path at the cost of losing single sign-on convenience. Where OIDC must stay enabled, restrict the application and its callback endpoint to trusted networks/VPN to reduce exposure to attacker-delivered callback URLs, and warn users not to follow unsolicited Leantime login links; note these are partial mitigations that reduce but do not eliminate the login-CSRF risk. Consult the VulnCheck advisory (https://www.vulncheck.com/advisories/leantime-oidc-login-csrf-via-unconditional-state-verification-stub) for details.