808 matches found
cognee (>=0.1.37, <=0.2.1.dev0), langchain-cognee (0.1.0) potentially affected by CVE-2025-68481 via fastapi-users (14.0.1)
fastapi-users PYPI version 14.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - cognee =0.1.37, =0.2.1.dev0 - langchain-cognee 0.1.0 Source cves: CVE-2025-68481 Source advisory: OSV:GHSA-5J53-63W8-8625...
balify (0.0.2), cognee (>=0.2.1.dev1, <=0.5.2) +35 more potentially affected by CVE-2025-68481 via fastapi-users (14.0.2)
fastapi-users PYPI version 14.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on fastapi-users and may be impacted: - balify 0.0.2 - cognee =0.2.1.dev1, =0.3.0, =0.1.2, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.2.0, =0.2.1 -...
GHSA-5J53-63W8-8625 FastAPI Users Vulnerable to 1-click Account Takeover in Apps Using FastAPI SSO
Description The OAuth login state tokens are completely stateless and carry no per-request entropy or any data that could link them to the session that initiated the OAuth flow. generatestatetoken is always called with an empty statedata dict, so the resulting JWT only contains the fixed audience...
Cross-site Request Forgery (CSRF)
Overview fastapi-users is a Ready-to-use and customizable users management for FastAPI Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the generatestatetoken function, which is called with an empty statedata dict, so the resulting JWT contains only the fixe...
balify (0.0.2), cognee (>=0.1.23, <=0.5.2) +49 more potentially affected by CVE-2025-68481 via fastapi-users (>=9.2.4, <=14.0.2)
fastapi-users PYPI version =9.2.4, =0.1.23, =0.3.0, =0.1.2, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.2.0, =0.2.1 - cognee-community-vector-adapter-redis 0.1.0 - cognee-community-vector-adapter-valkey 0.1.1 and more Source cves: CVE-2025-68481 Source advisory: MEND:CVE-2025-68481...
CVE-2025-68481 FastAPI Users Vulnerable to 1-click Account Takeover in Apps Using FastAPI SSO
FastAPI Users allows users to quickly add a registration and authentication system to their FastAPI project. Prior to version 15.0.2, the OAuth login state tokens are completely stateless and carry no per-request entropy or any data that could link them to the session that initiated the OAuth flo...
CVE-2025-68481 FastAPI Users Vulnerable to 1-click Account Takeover in Apps Using FastAPI SSO
FastAPI Users allows users to quickly add a registration and authentication system to their FastAPI project. Prior to version 15.0.2, the OAuth login state tokens are completely stateless and carry no per-request entropy or any data that could link them to the session that initiated the OAuth flo...
CVE-2025-68481
CVE-2025-68481 affects FastAPI Users. Before 15.0.2, OAuth state tokens are generated with an empty state_data, making the JWT contain only a fixed audience and expiry. The callback checks the state JWT but does not tie it to the user session, lacks a correlation cookie or server-side cache, and ...
EUVD-2025-204614
FastAPI Users allows users to quickly add a registration and authentication system to their FastAPI project. Prior to version 15.0.2, the OAuth login state tokens are completely stateless and carry no per-request entropy or any data that could link them to the session that initiated the OAuth flo...
CVE-2025-68481 FastAPI Users Vulnerable to 1-click Account Takeover in Apps Using FastAPI SSO
FastAPI Users allows users to quickly add a registration and authentication system to their FastAPI project. Prior to version 15.0.2, the OAuth login state tokens are completely stateless and carry no per-request entropy or any data that could link them to the session that initiated the OAuth flo...
CVE-2025-68481
FastAPI Users allows users to quickly add a registration and authentication system to their FastAPI project. Prior to version 15.0.2, the OAuth login state tokens are completely stateless and carry no per-request entropy or any data that could link them to the session that initiated the OAuth flo...
copilot-ollama-windows (>=1.0.0, <=1.0.2), dhscan-agent (>=0.1.7, <=0.1.8) +30 more potentially affected by CVE-2025-14546 via fastapi-sso (>=0.9.1, <=0.18.0)
fastapi-sso PYPI version =0.9.1, =1.0.0, =0.1.7, =2.5.43, =0.17.0, =1.0.0, =0.2.0, =2.13.3, =0.50.0, =0.5.0, =0.1.0, =0.0.1, =0.0.1, =2.0.0a1, =2.1.25 and more Source cves: CVE-2025-14546 Source advisory: OSV:GHSA-HP6R-R9VC-Q8WX...
copilot-ollama-windows (>=1.0.0, <=1.0.2), dhscan-agent (>=0.1.7, <=0.1.8) +30 more potentially affected by CVE-2025-14546 via fastapi-sso (>=0.9.1, <=0.18.0)
fastapi-sso PYPI version =0.9.1, =1.0.0, =0.1.7, =2.5.43, =0.17.0, =1.0.0, =0.2.0, =2.13.3, =0.50.0, =0.5.0, =0.1.0, =0.0.1, =0.0.1, =2.0.0a1, =2.1.25 and more Source cves: CVE-2025-14546 Source advisory: GHSA-HP6R-R9VC-Q8WX...
EUVD-2025-204438
FastAPI SSP is vulnerable to Cross-site Request Forgery CSRF through improper OAuth parameter validation...
FastAPI SSP is vulnerable to Cross-site Request Forgery (CSRF) through improper OAuth parameter validation
Versions of the package fastapi-sso before 0.19.0 are vulnerable to Cross-site Request Forgery CSRF due to the improper validation of the OAuth state parameter during the authentication callback. While the getloginurl method allows for state generation, it does not persist the state or bind it to...
GHSA-HP6R-R9VC-Q8WX FastAPI SSP is vulnerable to Cross-site Request Forgery (CSRF) through improper OAuth parameter validation
Versions of the package fastapi-sso before 0.19.0 are vulnerable to Cross-site Request Forgery CSRF due to the improper validation of the OAuth state parameter during the authentication callback. While the getloginurl method allows for state generation, it does not persist the state or bind it to...
CVE-2025-14546
Versions of the package fastapi-sso before 0.19.0 are vulnerable to Cross-site Request Forgery CSRF due to the improper validation of the OAuth state parameter during the authentication callback. While the getloginurl method allows for state generation, it does not persist the state or bind it to...
copilot-ollama-windows (>=1.0.0, <=1.0.2), dhscan-agent (>=0.1.7, <=0.1.8) +30 more potentially affected by CVE-2025-14546 via fastapi-sso (>=0.9.1, <=0.18.0)
fastapi-sso PYPI version =0.9.1, =1.0.0, =0.1.7, =2.5.43, =0.17.0, =1.0.0, =0.2.0, =2.13.3, =0.50.0, =0.5.0, =0.1.0, =0.0.1, =0.0.1, =2.0.0a1, =2.1.25 and more Source cves: CVE-2025-14546 Source advisory: MEND:CVE-2025-14546...
CVE-2025-14546
Versions of the package fastapi-sso before 0.19.0 are vulnerable to Cross-site Request Forgery CSRF due to the improper validation of the OAuth state parameter during the authentication callback. While the getloginurl method allows for state generation, it does not persist the state or bind it to...