CVE-2026-59713

Leantime - OIDC Login CSRF via Unconditional State Verification Stub

CVSS 8.6 HIGHEPSS 0.2%CWE-352

Vexday Risk Score

21Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 8.6EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

06 jul 2026Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

Leantime contains an OIDC login CSRF vulnerability in the verifyState() method that unconditionally returns true without validating state parameters. Attackers can craft malicious callback URLs with attacker-controlled authorization codes to perform session fixation, logging victims in as the attacker.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Productos afectados

Leantime · Leantime

Referencias

https://github.com/Leantime/leantime https://github.com/Leantime/leantime/commit/9630eb7db682fb1b4e23cdabf3428d03ec6f5094 https://github.com/Leantime/leantime/issues/3535 https://www.vulncheck.com/advisories/leantime-oidc-login-csrf-via-unconditional-state-verification-stub