CVE-2025-14546
CVE-2025-14546
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Versions of the package fastapi-sso before 0.19.0 are vulnerable to Cross-site Request Forgery (CSRF) due to the improper validation of the OAuth state parameter during the authentication callback. While the get_login_url method allows for state generation, it does not persist the state or bind it to the user's session. Consequently, the verify_and_process method accepts the state received in the query parameters without verifying it against a trusted local value. This allows a remote attacker to trick a victim into visiting a malicious callback URL, which can result in the attacker's account being linked to the victim's internal account.
CVSS 6.9 · Media · EPSS 0,4% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: python
Productos y versiones afectados
fastapi-sso
- Versiones
- ≥ 0, < 0.19.0: Afectada (semver)
Actualiza a 0.19.0
fastapi-sso PyPI
- Versiones
- 0.10.0
- 0.11.0
- 0.12.0
- 0.12.1
- 0.12.2
- 0.13.0
- 0.13.1
- 0.14.0
- 0.14.1
- 0.14.2
- 0.15.0
- 0.16.0
- 0.17.0
- 0.18.0
- 0.2.1
- 0.2.10
- 0.2.11
- 0.2.12
- 0.2.13
- 0.2.2
- 0.2.3
- 0.2.4
- 0.2.5
- 0.2.6
- 0.2.7
- 0.2.8
- 0.2.9
- 0.3.0
- 0.4.0
- 0.5.0
- 0.5.1
- 0.6.1
- 0.6.2
- 0.6.3
- 0.6.4
- 0.7.0
- 0.7.1
- 0.7.2
- 0.7.3
- 0.7.4
- 0.8.0
- 0.9.0
- 0.9.1
- Intervalos de versiones afectados
- ECOSYSTEM: < 0.19.0
Actualiza a 0.19.0