CVE-2026-34460
Medium · 5.4CVSS
5.4
EPSS
0.1%
Published
Jun 2, 2026
CISA due date
—
The record
NamelessMC is website software for Minecraft servers. In versions 2.2.4 and prior, the OAuth callback handling does not validate the state parameter server-side before exchanging the authorization code. This allows an attacker to capture a valid OAuth callback URL for their own account and cause a victim's browser to navigate to it, resulting in the victim's session being authenticated as the attacker-linked account (OAuth login CSRF / session swapping). This is patched in version 2.2.5.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-77508 Weblate is a web based localization tool. CWE-302
- CVE-2026-5423 @neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a… CWE-302
- CVE-2025-43992 Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0… CWE-302
- CVE-2026-28510 eLabFTW is an open source electronic lab notebook. CWE-302
- CVE-2026-40285 WeGIA is a web manager for charitable institutions. CWE-302
- CVE-2026-39429 kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes… CWE-302
- GHSA-6mq3-xmgp-pjm5 ZITADEL's truncated opaque tokens are still valid CWE-302
- CVE-2026-27840 ZITADEL is an open source identity management platform. CWE-302