CVE-2026-59713CWE-352csrf

CVE-2026-59713

High · published July 7, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
13.5
In the wild
Unconfirmed
What it is

Leantime contains an OIDC login CSRF vulnerability in the verifyState() method that unconditionally returns true without validating state parameters. Attackers can craft malicious callback URLs with attacker-controlled authorization codes to perform session fixation, logging victims in as the attacker.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00234 · 13.5th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2026-07-07T01:16Z
References (4)
https://github.com/Leantime/leantime · [email protected]https://github.com/Leantime/leantime/commit/9630eb7db682fb1b4e23cdabf3428d03ec6f5094 · [email protected]https://github.com/Leantime/leantime/issues/3535 · [email protected]https://www.vulncheck.com/advisories/leantime-oidc-login-csrf-via-unconditional-state-verification-stub · [email protected]
EPSS history
Timeline
  • 06 JUL 20:36Z
    Leantime - OIDC Login CSRF via Unconditional State Verification Stub
    cvelistv5