CVE-2025-68481

CVE-2025-68481 affects FastAPI Users prior to version 15.0.2. The issue stems from stateless OAuth login state tokens: generate_state_token() is invoked with an empty state_data dict, producing a JWT with only a fixed audience and expiration. On callback, the state is only validated for signature...