GHSA-HP6R-R9VC-Q8WX FastAPI SSP is vulnerable to Cross-site Request Forgery (CSRF) through improper OAuth parameter validation

Versions of the package fastapi-sso before 0.19.0 are vulnerable to Cross-site Request Forgery CSRF due to the improper validation of the OAuth state parameter during the authentication callback. While the getloginurl method allows for state generation, it does not persist the state or bind it to...

EUVD-2025-204438

FastAPI SSP is vulnerable to Cross-site Request Forgery CSRF through improper OAuth parameter validation...

copilot-ollama-windows (>=1.0.0, <=1.0.2), dhscan-agent (>=0.1.7, <=0.1.8) +30 more potentially affected by CVE-2025-14546 via fastapi-sso (>=0.9.1, <=0.18.0)

fastapi-sso PYPI version =0.9.1, =1.0.0, =0.1.7, =2.5.43, =0.17.0, =1.0.0, =0.2.0, =2.13.3, =0.50.0, =0.5.0, =0.1.0, =0.0.1, =0.0.1, =2.0.0a1, =2.1.25 and more Source cves: CVE-2025-14546 Source advisory: OSV:GHSA-HP6R-R9VC-Q8WX...

FastAPI SSP is vulnerable to Cross-site Request Forgery (CSRF) through improper OAuth parameter validation

Versions of the package fastapi-sso before 0.19.0 are vulnerable to Cross-site Request Forgery CSRF due to the improper validation of the OAuth state parameter during the authentication callback. While the getloginurl method allows for state generation, it does not persist the state or bind it to...

copilot-ollama-windows (>=1.0.0, <=1.0.2), dhscan-agent (>=0.1.7, <=0.1.8) +30 more potentially affected by CVE-2025-14546 via fastapi-sso (>=0.9.1, <=0.18.0)

fastapi-sso PYPI version =0.9.1, =1.0.0, =0.1.7, =2.5.43, =0.17.0, =1.0.0, =0.2.0, =2.13.3, =0.50.0, =0.5.0, =0.1.0, =0.0.1, =0.0.1, =2.0.0a1, =2.1.25 and more Source cves: CVE-2025-14546 Source advisory: GHSA-HP6R-R9VC-Q8WX...

CVE-2025-14546

Versions of the package fastapi-sso before 0.19.0 are vulnerable to Cross-site Request Forgery CSRF due to the improper validation of the OAuth state parameter during the authentication callback. While the getloginurl method allows for state generation, it does not persist the state or bind it to...

CVE-2025-14546

Versions of the package fastapi-sso before 0.19.0 are vulnerable to Cross-site Request Forgery CSRF due to the improper validation of the OAuth state parameter during the authentication callback. While the getloginurl method allows for state generation, it does not persist the state or bind it to...

CVE-2025-14546

CVE-2025-14546 affects fastapi-sso

copilot-ollama-windows (>=1.0.0, <=1.0.2), dhscan-agent (>=0.1.7, <=0.1.8) +30 more potentially affected by CVE-2025-14546 via fastapi-sso (>=0.9.1, <=0.18.0)

fastapi-sso PYPI version =0.9.1, =1.0.0, =0.1.7, =2.5.43, =0.17.0, =1.0.0, =0.2.0, =2.13.3, =0.50.0, =0.5.0, =0.1.0, =0.0.1, =0.0.1, =2.0.0a1, =2.1.25 and more Source cves: CVE-2025-14546 Source advisory: MEND:CVE-2025-14546...

FastAPI SSO security vulnerability

FastAPI SSO is a FastAPI plugin from the individual developer Tomas Votava. A security vulnerability exists in FastAPI SSO versions prior to 0.19.0, which stems from improper validation of the OAuth status parameter and could lead to a cross-site request forgery attack...

PT-2025-52515

Name of the Vulnerable Software and Affected Versions FastAPI Users versions prior to 15.0.2 Description FastAPI Users is a system designed to add registration and authentication to FastAPI projects. A login Cross-Site Request Forgery CSRF exists because OAuth login state tokens are stateless and...

FastAPI Users: Cross-Site Request Forgery Vulnerability

FastAPI Users is a customizable user management interface from FastAPI Users open source. A cross-site request forgery vulnerability exists in FastAPI Users versions prior to 15.0.2, which stems from stateless OAuth login status tokens and missing correlation data, which could lead to login CSRF...

CVE-2025-68481: Improper Authorization

FastAPI Users allows users to quickly add a registration and authentication system to their FastAPI project. Prior to version 15.0.2, the OAuth login state tokens are completely stateless and carry no per-request entropy or any data that could link them to the session that initiated the OAuth flo...

CVE-2025-14546: Improper Authorization

Versions of the package fastapi-sso before 0.19.0 are vulnerable to Cross-site Request Forgery CSRF due to the improper validation of the OAuth state parameter during the authentication callback. While the getloginurl method allows for state generation, it does not persist the state or bind it to...

copilot-ollama-windows (>=1.0.0, <=1.0.2), dhscan-agent (>=0.1.7, <=0.1.8) +30 more potentially affected by CVE-2025-14546 via fastapi-sso (>=0.9.1, <=0.18.0)

fastapi-sso PYPI version =0.9.1, =1.0.0, =0.1.7, =2.5.43, =0.17.0, =1.0.0, =0.2.0, =2.13.3, =0.50.0, =0.5.0, =0.1.0, =0.0.1, =0.0.1, =2.0.0a1, =2.1.25 and more Source cves: CVE-2025-14546 Source advisory: SNYK:PYTHON-FASTAPISSO-14386403...

Cross-site Request Forgery (CSRF)

Overview fastapi-sso is a FastAPI plugin to enable SSO to most common providers such as Facebook login, Google login and login via Microsoft Office 365 Account Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF due to the improper validation of the OAuth state...

CVE-2025-66454

Arcade MCP allows you to to create, deploy, and share MCP Servers. Prior to 1.5.4, the arcade-mcp HTTP server uses a hardcoded default worker secret "dev" that is never validated or overridden during normal server startup. As a result, any unauthenticated attacker who knows this default key can...

GHSA-G2JX-37X6-6438 arcade-mcp-server Has Default Hardcoded Worker Secret That Allows Full Unauthorized Access to All HTTP MCP Worker Endpoints

Summary The arcade-mcp HTTP server uses a hardcoded default worker secret "dev" that is never validated or overridden during normal server startup. As a result, any unauthenticated attacker who knows this default key can forge valid JWTs and fully bypass the FastAPI authentication layer. This...

my-fastapi-scaffold (>=0.1.0, <=0.4.0), platform-base-lib (>=0.1.0, <=0.1.6) potentially affected by unknown CVE via fastcrud (>=0.15.1, <=0.16.0)

fastcrud PYPI version =0.15.1, =0.1.0, =0.1.0, =0.1.6 Source cves: unknown CVE Source advisory: SNYK:PYTHON-FASTCRUD-14172730...

[SECURITY] Fedora 43 Update: python-fastapi-0.120.1-1.fc43

FastAPI is a modern, fast high-performance, web framework for building APIs with Python based on standard Python type hints. The key features are: =E2=80=A2 Fast: Very high performance, on par with NodeJS and Go thanks to Starlette and Pydantic. One of the fastest Python frameworks available...