CyberRota Analysis
AI-GeneratedLeantime is vulnerable to a CSRF attack in the OIDC login process, specifically within the verifyState() method, which fails to validate state parameters, allowing attackers to exploit this flaw. This can lead to session fixation, enabling attackers to log in as victims using malicious callback URLs with forged authorization codes. Organizations utilizing Leantime should prioritize addressing this vulnerability to protect user sessions and prevent unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Leantime contains an OIDC login CSRF vulnerability in the verifyState() method that unconditionally returns true without validating state parameters. Attackers can craft malicious callback URLs with attacker-controlled authorization codes to perform session fixation, logging victims in as the attacker.