CVE-2026-18165
MediumCVSS 4.2Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
The @fastify/oauth2 plugin for Fastify, versions 7.2.0 up to but not including 8.3.0, improperly validates the OAuth state and PKCE code verifier by comparing callback query parameters against an unprefixed, predictable cookie, with no server-side binding to the browser. An attacker can set cookies and perform a login CSRF attack, silently signing the victim into the attacker's account. The fix in 8.3.0 adds an opt-in hostPrefixedCookies option.
Risk Assessment
A login CSRF attack can lead to unauthorized login of the user into the attacker's account, potentially resulting in data theft or unauthorized actions within the application context.
Recommendation
Upgrade @fastify/oauth2 to version 8.3.0 and enable the hostPrefixedCookies option, or bind state to a server-side session.
Original NVD description (English source)
@fastify/oauth2 is an OAuth 2.0 plugin for Fastify. In versions from 7.2.0 up to but not including 8.3.0, the plugin validates the OAuth state, and with PKCE the code verifier, by comparing the callback query parameter against an unprefixed, predictable cookie, with no server-side binding to the browser that began the flow. Any party able to write a cookie for the application's host, such as a sibling subdomain under the same registrable domain, can plant matching state and verifier cookies and complete an attacker-owned OAuth flow inside a victim's browser, silently signing the victim in to the attacker's account (login CSRF). It does not expose the victim's own account, credentials, or tokens. The issue is fixed in @fastify/oauth2 8.3.0, which adds an opt-in hostPrefixedCookies option. Users should upgrade to 8.3.0 and enable it, or bind state to a server-side session.