Snowflake Jdbc Driver Thin
Monthly
Snowflake client drivers that implement the `authenticator=externalbrowser` single sign-on flow expose a local loopback HTTP callback listener that reflects an arbitrary request's Origin header into its CORS response and accepts the first token-bearing request during the login window without checking a login-bound CSRF state value. An attacker who can reach that listener while a victim is mid-login and wins the race to deliver the first token-bearing request can submit a forged IdP callback, causing the authentication attempt to fail; there is no token theft, authentication bypass, or data disclosure, so the CVSS 6.5 score is driven entirely by availability impact (C:N/I:N/A:H) with user interaction required (AV:N/AC:H/PR:N/UI:R). Affected are unpatched releases of the Python connector, Go driver, JDBC (including FIPS and thin artifacts), Node.js, .NET, ODBC, PHP PDO drivers, and libsnowflakeclient; fixed versions are published for each and users must upgrade manually, and no public exploit code has been identified at the time of analysis.
Snowflake client drivers that implement the `authenticator=externalbrowser` single sign-on flow expose a local loopback HTTP callback listener that reflects an arbitrary request's Origin header into its CORS response and accepts the first token-bearing request during the login window without checking a login-bound CSRF state value. An attacker who can reach that listener while a victim is mid-login and wins the race to deliver the first token-bearing request can submit a forged IdP callback, causing the authentication attempt to fail; there is no token theft, authentication bypass, or data disclosure, so the CVSS 6.5 score is driven entirely by availability impact (C:N/I:N/A:H) with user interaction required (AV:N/AC:H/PR:N/UI:R). Affected are unpatched releases of the Python connector, Go driver, JDBC (including FIPS and thin artifacts), Node.js, .NET, ODBC, PHP PDO drivers, and libsnowflakeclient; fixed versions are published for each and users must upgrade manually, and no public exploit code has been identified at the time of analysis.