Snowflake Client Drivers EUVD-2026-116883

Exploitation is limited to drivers configured with the externalbrowser SSO authenticator (authenticator=externalbrowser); other authentication methods (password, key-pair, etc.) are unaffected. The victim must be actively performing an SSO login (UI:R), and the attacker must be able to reach the local loopback callback listener during that specific login window - the reflected arbitrary Origin in the CORS response plus the absence of a login-bound CSRF state check is what lets a cross-origin/forged request be accepted. The attacker must also win the race to deliver the first token-bearing request before the legitimate IdP callback arrives. Limiting factors: the only outcome is denial of that login attempt (no credential theft, token replay, or data exposure); exploitation requires an in-progress login and the narrow timing window; and only the externalbrowser deployment mode on unpatched driver versions is in scope.

This is a medium-severity issue (CVSS 6.5) whose score is driven entirely by availability impact (C:N/I:N/A:H): a successful attack causes a user's single sign-on login attempt to FAIL - it does not steal tokens, bypass authentication, or disclose data. The input shows no CISA KEV listing and no public exploit reference, so exploitation status is: no public exploit identified at time of analysis. No EPSS probability was supplied, so widespread-exploitation likelihood cannot be quantified from the data. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a real-but-non-urgent, patch-in-normal-cycle priority. One signal conflict worth flagging: the supplied NVD vector uses AC:L, but the description states the listener 'accepted the first token-bearing request it received during the login window,' which implies the attacker must win a timing race against the legitimate IdP response during a narrow active-login window - I therefore independently assess AC:H. Overall this is a low-to-moderate real-world priority: it only degrades login availability for users of the externalbrowser SSO flow and requires user interaction plus a timing race, so it does not warrant emergency patching but should be remediated in the normal maintenance window.

A user initiates an interactive externalbrowser (SSO) login using an affected Snowflake driver, which opens a local loopback listener to receive the identity provider's callback. An attacker who can reach that listener during the active login window - for example by luring the victim to a malicious web page that issues a cross-origin request to the localhost listener (enabled by the reflected Origin/CORS header and the missing CSRF state check) - submits a forged token-bearing callback that is accepted first, causing the legitimate login attempt to fail. No public exploit code or PoC reference is present in the supplied data.