GHSA-hp6r-r9vc-q8wx

Suggest an improvement
Source
https://github.com/advisories/GHSA-hp6r-r9vc-q8wx
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-hp6r-r9vc-q8wx/GHSA-hp6r-r9vc-q8wx.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-hp6r-r9vc-q8wx
Aliases
Published
2025-12-19T06:30:27Z
Modified
2025-12-19T21:41:17.488793Z
Severity
  • 6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N CVSS Calculator
  • 5.4 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
FastAPI SSP is vulnerable to Cross-site Request Forgery (CSRF) through improper OAuth parameter validation
Details

Versions of the package fastapi-sso before 0.19.0 are vulnerable to Cross-site Request Forgery (CSRF) due to the improper validation of the OAuth state parameter during the authentication callback. While the getloginurl method allows for state generation, it does not persist the state or bind it to the user's session. Consequently, the verifyandprocess method accepts the state received in the query parameters without verifying it against a trusted local value. This allows a remote attacker to trick a victim into visiting a malicious callback URL, which can result in the attacker's account being linked to the victim's internal account.

Database specific 
{
    "github_reviewed": true,
    "nvd_published_at": "2025-12-19T05:16:09Z",
    "cwe_ids": [
        "CWE-285"
    ],
    "github_reviewed_at": "2025-12-19T21:08:32Z",
    "severity": "MODERATE"
}
References

Affected packages

PyPI / fastapi-sso

Package

Name
fastapi-sso
View open source insights on deps.dev
Purl
pkg:pypi/fastapi-sso

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.19.0

Affected versions

0.*
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.2.7
0.2.8
0.2.9
0.2.10
0.2.11
0.2.12
0.2.13
0.3.0
0.4.0
0.5.0
0.5.1
0.6.1
0.6.2
0.6.3
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.8.0
0.9.0
0.9.1
0.10.0
0.11.0
0.12.0
0.12.1
0.12.2
0.13.0
0.13.1
0.14.0
0.14.1
0.14.2
0.15.0
0.16.0
0.17.0
0.18.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-hp6r-r9vc-q8wx/GHSA-hp6r-r9vc-q8wx.json"