75 matches found
CVE-2026-18165 @fastify/oauth2 vulnerable to Login CSRF via plantable OAuth state cookies
@fastify/oauth2 is an OAuth 2.0 plugin for Fastify. In versions from 7.2.0 up to but not including 8.3.0, the plugin validates the OAuth state, and with PKCE the code verifier, by comparing the callback query parameter against an unprefixed, predictable cookie, with no server-side binding to the...
Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them
Summary Auth.js stores the OAuth/OIDC anti-CSRF checks state, nonce, and the PKCE verifier in global cookies that are not bound to the provider that created them. On callback, a check value minted during a sign-in started with one provider can satisfy the callback for a different provider, becaus...
OESA-2026-3009 mod_auth_openidc security update
This module enables an Apache 2.x web server to operate as an OpenID Connect Relying PartyRP to an OpenID Connect ProviderOP. Security Fixes: An out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of modauthopenidc. oidcstatecookiesparsetoken src/state.c scans a...
OESA-2026-3012 mod_auth_openidc security update
This module enables an Apache 2.x web server to operate as an OpenID Connect Relying PartyRP to an OpenID Connect ProviderOP. Security Fixes: An out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of modauthopenidc. oidcstatecookiesparsetoken src/state.c scans a...
OESA-2026-3010 mod_auth_openidc security update
This module enables an Apache 2.x web server to operate as an OpenID Connect Relying PartyRP to an OpenID Connect ProviderOP. Security Fixes: An out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of modauthopenidc. oidcstatecookiesparsetoken src/state.c scans a...
OESA-2026-3011 mod_auth_openidc security update
This module enables an Apache 2.x web server to operate as an OpenID Connect Relying PartyRP to an OpenID Connect ProviderOP. Security Fixes: An out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of modauthopenidc. oidcstatecookiesparsetoken src/state.c scans a...
PT-2026-65744
Name of the Vulnerable Software and Affected Versions mod auth openidc affected versions not specified Description An out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of mod auth openidc. The function oidc state cookies parse token in src/state.c scans a cook...
nebula-mesh: Session and OIDC state cookies lack the Secure attribute
internal/web/session.go and internal/web/oidc.go set HttpOnly and SameSite=Lax on every cookie but never Secure. A single plaintext request to the origin operator on a LAN, mistyped URL, HTTP→HTTPS not strictly enforced, reverse proxy misconfiguration discloses the session. Affected All released...
CVE-2024-37830
An issue in Outline = v0.76.1 allows attackers to redirect a victim user to a malicious site via intercepting and changing the state cookie...
CVE-2024-37830
An issue in Outline = v0.76.1 allows attackers to redirect a victim user to a malicious site via intercepting and changing the state cookie...
CVE-2024-37830
Summary: CVE-2024-37830 affects Outline up to v0.76.1. An issue allows an attacker to redirect a victim to a malicious site by intercepting and modifying the app’s state cookie. The vulnerability is described across Red Hat, NVD, CVE listings and partner advisories, with the recommended fix being...
PT-2024-27773 · Outline · Outline
Name of the Vulnerable Software and Affected Versions: Outline versions 0.76.1 and earlier Description: An issue allows attackers to redirect a victim user to a malicious site via intercepting and changing the state cookie. Recommendations: For Outline versions 0.76.1 and earlier, update to a...
CVE-2024-37830
An issue in Outline = v0.76.1 allows attackers to redirect a victim user to a malicious site via intercepting and changing the state cookie...
