CVE-2026-86467

Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the browser that began it. The login handler discards the AuthnRequest ID and the callback validates the assertion without requiring a matching InResponseTo, so an unauthenticated...

CVE-2026-86467 Apache Airflow Amazon provider: AWS auth manager: SAML login CSRF logs users into the attacker's account

Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the browser that began it. The login handler discards the AuthnRequest ID and the callback validates the assertion without requiring a matching InResponseTo, so an unauthenticated...

CVE-2026-86467

The Apache Airflow Amazon provider is vulnerable to a login-CSRF attack via the AWS auth manager 's SAML login flow. The vulnerability occurs because the login handler discards the AuthnRequest ID and the callback validates assertions without requiring a matching InResponseTo value. This allows a...

EUVD-2026-104790

Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the browser that began it. The login handler discards the AuthnRequest ID and the callback validates the assertion without requiring a matching InResponseTo, so an unauthenticated...

CVE-2026-86467

Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the browser that began it. The login handler discards the AuthnRequest ID and the callback validates the assertion without requiring a matching InResponseTo, so an unauthenticated...

CVE-2026-86467 Apache Airflow Amazon provider: AWS auth manager: SAML login CSRF logs users into the attacker's account

Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the browser that began it. The login handler discards the AuthnRequest ID and the callback validates the assertion without requiring a matching InResponseTo, so an unauthenticated...

PT-2026-118101

Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the browser that began it. The login handler discards the AuthnRequest ID and the callback validates the assertion without requiring a matching InResponseTo, so an unauthenticated...

CVE-2026-110008

@fastify/oauth2 is a Fastify wrapper for OAuth2 login flows. In versions 7.2.0 through 8.3.1, the state and code-verifier cookies are set without a Path attribute at a login route with two or more path segments, while the clearing step at the OAuth callback writes them with a root path, so the...

CVE-2026-110008

The @fastify/oauth2 library (versions 7.2.0 through 8.3.1 ) is vulnerable to Login CSRF because state and code-verifier cookies are set without a Path attribute on routes with multiple segments. During the OAuth callback, the clearing step uses a root path, causing the original cookies to persist...

CVE-2026-110008 @fastify/oauth2 vulnerable to Login CSRF via OAuth state cookie not cleared after callback

@fastify/oauth2 is a Fastify wrapper for OAuth2 login flows. In versions 7.2.0 through 8.3.1, the state and code-verifier cookies are set without a Path attribute at a login route with two or more path segments, while the clearing step at the OAuth callback writes them with a root path, so the...

CVE-2026-110008 @fastify/oauth2 vulnerable to Login CSRF via OAuth state cookie not cleared after callback

@fastify/oauth2 is a Fastify wrapper for OAuth2 login flows. In versions 7.2.0 through 8.3.1, the state and code-verifier cookies are set without a Path attribute at a login route with two or more path segments, while the clearing step at the OAuth callback writes them with a root path, so the...

EUVD-2026-104327

@fastify/oauth2 is a Fastify wrapper for OAuth2 login flows. In versions 7.2.0 through 8.3.1, the state and code-verifier cookies are set without a Path attribute at a login route with two or more path segments, while the clearing step at the OAuth callback writes them with a root path, so the...

Exploit for CVE-2026-84178

CVE-2026-84178 — camel-oauth: authorization-code callback logi...

CVE-2026-112050 Gitify before 7.10.0 Login CSRF via Missing OAuth State Validation

Gitify before 7.10.0 contains a login cross-site request forgery vulnerability that allows remote attackers to bind a victim's client to their account because performGitHubWebOAuth omits OAuth state validation. Attackers can get a gitify://oauth?code= link with their own authorization code opened...

CVE-2026-112050

Versions of Gitify before 7.10.0 are vulnerable to a login cross-site request forgery (CSRF) . The issue stems from the performGitHubWebOAuth() function omitting OAuth state validation . A remote attacker can trick a victim into binding their client to the attacker's account by providing a gitify...

CVE-2026-112050 Gitify before 7.10.0 Login CSRF via Missing OAuth State Validation

Gitify before 7.10.0 contains a login cross-site request forgery vulnerability that allows remote attackers to bind a victim's client to their account because performGitHubWebOAuth omits OAuth state validation. Attackers can get a gitify://oauth?code= link with their own authorization code opened...

Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)

Summary In the Casdoor SSO flow, the OAuth state parameter is hard-coded to settings.CasdoorSettings.Application — a value identical for every user and every login. The callback handler accepts whatever state the client sends without comparing it to anything stored in the user agent, enabling a...

GHSA-44XR-MRHH-QM78 Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)

Summary In the Casdoor SSO flow, the OAuth state parameter is hard-coded to settings.CasdoorSettings.Application — a value identical for every user and every login. The callback handler accepts whatever state the client sends without comparing it to anything stored in the user agent, enabling a...

Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign)

Impact Applications using the LINE Login backend are vulnerable to login CSRF / forced authentication. An attacker can start a LINE authorization flow for an account they control and trick a victim into visiting the callback URL with the attacker’s authorization code. Because the LINE backend did...

CVE-2026-84312 Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GetCasdoorUri uses the configured Casdoor application name as a constant OAuth state value and CasdoorCallback does not compare the submitted state with a value bound to the initiating browser session. An unauthenticated...