https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 28 Oct 2026 00:18:37 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-204640 EUVD-2026-204640 https://cve.radiocsirt.org/vuln/euvd-2026-204640 https://cve.radiocsirt.org/vuln/fkie_cve-2023-31999 <p>All versions of @fastify/oauth2 used a statically generated state parameter at startup time and were used across all requests for all users. The purpose of the Oauth2 state parameter is to prevent Cross-Site-Request-Forgery attacks. As such, it should be unique per user and should be connected to the user&#39;s session in some way that will allow the server to validate it. v7.2.0 changes the default behavior to store the state in a cookie with the http-only and same-site=lax attributes set. The state is now by default generated for every user. Note that this contains a breaking change in the checkStateFunction function, which now accepts the full Request object.</p> <p>All versions of @fastify/oauth2 used a statically generated state parameter at startup time and were used across all requests for all users. The purpose of the Oauth2 state parameter is to prevent Cross-Site-Request-Forgery attacks. As such, it should be unique per user and should be connected to the user&#39;s session in some way that will allow the server to validate it. v7.2.0 changes the default behavior to store the state in a cookie with the http-only and same-site=lax attributes set. The state is now by default generated for every user. Note that this contains a breaking change in the checkStateFunction function, which now accepts the full Request object.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-31999 https://cve.radiocsirt.org/vuln/ghsa-g8x5-p9qc-cf95 <p><strong>Affected:</strong> npm: @fastify/oauth2</p> <p>### Impact</p> <p>All versions of @fastify/oauth2 used a statically generated `state` parameter at startup time and were used across all requests for all users. The purpose of the Oauth2 `state` parameter is to prevent Cross-Site-Request-Forgery attacks. As such, it should be unique per user and should be connected to the user&#39;s session in some way that will allow the server to validate it.</p> <p>### Patches</p> <p>v7.2.0 changes the default behavior to store the `state` in a cookie with the `http-only` and `same-site=lax` attributes set. The state is now by default generated for every user.</p> <p>Note that this contains a breaking change in the `checkStateFunction` function, which now accepts the full `Request` object.</p> <p>### Workarounds</p> <p>There are no known workarounds.</p> <p>### References</p> <p>* [Prevent Attacks and Redirect Users with OAuth 2.0 State Parameters](https://auth0.com/docs/secure/attack-protection/state-parameters)</p> <p><strong>Affected:</strong> npm: @fastify/oauth2</p> <p>### Impact</p> <p>All versions of @fastify/oauth2 used a statically generated `state` parameter at startup time and were used across all requests for all users. The purpose of the Oauth2 `state` parameter is to prevent Cross-Site-Request-Forgery attacks. As such, it should be unique per user and should be connected to the user&#39;s session in some way that will allow the server to validate it.</p> <p>### Patches</p> <p>v7.2.0 changes the default behavior to store the `state` in a cookie with the `http-only` and `same-site=lax` attributes set. The state is now by default generated for every user.</p> <p>Note that this contains a breaking change in the `checkStateFunction` function, which now accepts the full `Request` object.</p> <p>### Workarounds</p> <p>There are no known workarounds.</p> <p>### References</p> <p>* [Prevent Attacks and Redirect Users with OAuth 2.0 State Parameters](https://auth0.com/docs/secure/attack-protection/state-parameters)</p> https://cve.radiocsirt.org/vuln/ghsa-g8x5-p9qc-cf95 https://cve.radiocsirt.org/vuln/gsd-2023-31999 gsd-2023-31999 https://cve.radiocsirt.org/vuln/gsd-2023-31999