CVE-2025-14546

The record

Versions of the package fastapi-sso before 0.19.0 are vulnerable to Cross-site Request Forgery (CSRF) due to the improper validation of the OAuth state parameter during the authentication callback. While the get_login_url method allows for state generation, it does not persist the state or bind it to the user's session. Consequently, the verify_and_process method accepts the state received in the query parameters without verifying it against a trusted local value. This allows a remote attacker to trick a victim into visiting a malicious callback URL, which can result in the attacker's account being linked to the victim's internal account.

Affected packages

Related vulnerabilities

• GHSA-hp6r-r9vc-q8wx FastAPI SSP is vulnerable to Cross-site Request Forgery (CSRF) through improper OAuth… Same vulnerability
• CVE-2026-85543 Some Wi-Fi series camera products have insufficient permission validation on certain… CWE-285
• CVE-2026-21097 Improper authentication in ActivityTaskManagerService prior to SMR Sep-2026 Release 1… CWE-285
• CVE-2026-86804 A vulnerability was identified in seakee CPA-Manager-Plus up to 1.11.10. CWE-285
• CVE-2026-86277 A vulnerability has been found in SourceCodester Syllabus-Aligned Learning Management &… CWE-285
• CVE-2026-86283 MISP's UiBeta theme collection view (app/View/Themed/UiBeta/Collections/view.ctp)… CWE-285
• CVE-2026-86212 A vulnerability has been found in Open5GS 2.7.7/2.8.0. CWE-285
• CVE-2026-86183 A vulnerability was identified in diem-project diem up to 5.1.3. CWE-285