Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-110008: @fastify/oauth2 allows login CSRF attack

CVE-2026-110008 · published 16 days ago

Summary

The Fastify OAuth2 plugin versions 7.2.0 through 8.3.1 keep a login cookie after the OAuth callback, so an attacker can reuse the saved state and log a user into the attacker’s account. Upgrade to version 8.3.2 or newer, or configure the cookie with an explicit path to ensure it is removed correctly.

What to do

Update @fastify/oauth2 @fastify/oauth2 to version 8.3.2 or later.

Affected software

Vendor	Product	Affected versions
@fastify/oauth2	@fastify/oauth2	< 8.3.2

Original advisory text

@fastify/oauth2 vulnerable to Login CSRF via OAuth state cookie not cleared after callback

@fastify/oauth2 is a Fastify wrapper for OAuth2 login flows. In versions 7.2.0 through 8.3.1, the state and code-verifier cookies are set without a Path attribute at a login route with two or more path segments, while the clearing step at the OAuth callback writes them with a root path, so the original cookies survive the callback and the documented single-use guarantee for the state value does not hold. A state value an attacker learns stays valid for the rest of the browser session, letting the attacker drive their own authorization flow in the victim's browser and sign the victim in to the attacker's account (login CSRF). The issue is fixed in @fastify/oauth2 8.3.2, and users should upgrade to 8.3.2 or later. As a workaround, set an explicit cookie path so the set and the clear name the same cookie.

References

https://cna.openjsf.org/security-advisories.html Vendor Advisory
https://github.com/fastify/fastify-oauth2/security/advisories/GHSA-7fcr-mwg4-pw9... Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-1100... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-110008 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

4.2 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-352Cross-Site Request Forgery (CSRF)

CWE-459Incomplete Cleanup

CWE-613Insufficient Session Expiration

Timeline

Published19 Oct 2026

Updated20 Oct 2026

First seen19 Oct 2026

Sources

CVE-2026-110008 · NVD

CVE-2026-110008 · MITRE

CVE-2026-110008 · OSV

GHSA-7fcr-mwg4-pw9q · GHSA

Track software like this

Free during beta