CVE-2025-14546

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-14546
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-14546.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-14546
Aliases
Published
2025-12-19T05:16:09.497Z
Modified
2026-03-12T17:38:02.159704Z
Severity
  • 5.4 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
Summary
[none]
Details

Versions of the package fastapi-sso before 0.19.0 are vulnerable to Cross-site Request Forgery (CSRF) due to the improper validation of the OAuth state parameter during the authentication callback. While the getloginurl method allows for state generation, it does not persist the state or bind it to the user's session. Consequently, the verifyandprocess method accepts the state received in the query parameters without verifying it against a trusted local value. This allows a remote attacker to trick a victim into visiting a malicious callback URL, which can result in the attacker's account being linked to the victim's internal account.

References

Affected packages

Git / github.com/tomasvotava/fastapi-sso

Affected ranges

Type
GIT
Repo
https://github.com/tomasvotava/fastapi-sso
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c905eafe2d6d7aab5d2b929e53ba98f238fdb21d
Fixed
6117d1a5ad498ba57d671e8a059ebe20db5abe02
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.19.0"
        }
    ]
}

Affected versions

0.*
0.10.0
0.11.0
0.12.0
0.12.1
0.12.2
0.13.0
0.13.1
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
0.17.0
0.18.0
0.2.10
0.2.11
0.2.12
0.2.13
0.2.21
0.2.3
0.2.9
0.3.0
0.4.0
0.5.0
0.5.1
0.6.1
0.6.2
0.6.3
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.8.0
0.9.0
0.9.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-14546.json"