Broken authentication on Logitech Options due to misvalidation of Oauth state parameter
CVE-2022-0916

8.4HIGH

Key Information:

Vendor

Logitech

Status
Options
Vendor
CVE Published:
3 May 2022

What is CVE-2022-0916?

An issue was discovered in Logitech Options. The OAuth 2.0 state parameter was not properly validated. This leaves applications vulnerable to CSRF attacks during authentication and authorization operations.

Affected Version(s)

Options Windows 9.60.87

References

https://support.logi.com/hc/en-us/articles/360025297893
x_refsource_MISC

CVSS V3.1

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Karan Bamal
.