Fastify Oauth2
Monthly
Login CSRF in @fastify/oauth2 7.2.0 through 8.3.1 allows an attacker who has learned a valid OAuth2 state value to complete an authorization flow in a victim's browser and silently sign the victim in to the attacker's account, because state and code-verifier cookies set at login routes with two or more path segments lack a Path attribute and are not cleared by the callback's root-path deletion. The flaw is limited to multi-segment login routes and requires user interaction plus a known state value, is rated CVSS 4.2 with high attack complexity, and is fixed in 8.3.2; no public exploit code or CISA KEV entry was identified at time of analysis.
Login CSRF in @fastify/oauth2 versions 7.2.0 through 8.2.x allows an attacker controlling a sibling subdomain to plant predictable OAuth state and PKCE code verifier cookies, silently signing a victim into the attacker's account instead of their own. The root cause is the absence of server-side session binding and cookie prefixing - the plugin validates OAuth state exclusively by comparing callback parameters against unprefixed cookies, which sibling subdomains sharing the same registrable domain can freely overwrite. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept exists; the high attack complexity limits opportunistic risk.
Login CSRF in @fastify/oauth2 7.2.0 through 8.3.1 allows an attacker who has learned a valid OAuth2 state value to complete an authorization flow in a victim's browser and silently sign the victim in to the attacker's account, because state and code-verifier cookies set at login routes with two or more path segments lack a Path attribute and are not cleared by the callback's root-path deletion. The flaw is limited to multi-segment login routes and requires user interaction plus a known state value, is rated CVSS 4.2 with high attack complexity, and is fixed in 8.3.2; no public exploit code or CISA KEV entry was identified at time of analysis.
Login CSRF in @fastify/oauth2 versions 7.2.0 through 8.2.x allows an attacker controlling a sibling subdomain to plant predictable OAuth state and PKCE code verifier cookies, silently signing a victim into the attacker's account instead of their own. The root cause is the absence of server-side session binding and cookie prefixing - the plugin validates OAuth state exclusively by comparing callback parameters against unprefixed cookies, which sibling subdomains sharing the same registrable domain can freely overwrite. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept exists; the high attack complexity limits opportunistic risk.