Description
Leantime contains an OIDC login CSRF vulnerability in the verifyState() method that unconditionally returns true without validating state parameters. Attackers can craft malicious callback URLs with attacker-controlled authorization codes to perform session fixation, logging victims in as the attacker.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Leantime | Leantime | ≤ 3.4.4 | — |
References
- GitHub Issue issue-tracking
- Product product
- Patch Commit patch
- https://www.vulncheck.com/advisories/leantime-oidc-login-csrf-via-unconditional-state-verification-stub third-party-advisory