Vulnerability in Fastify OAuth2 Affects User Session Security

CVE-2023-31999

What is CVE-2023-31999?

Fastify OAuth2 prior to version 7.2.0 utilized a static state parameter across all user sessions, significantly undermining its effectiveness in preventing Cross-Site Request Forgery attacks. This vulnerability allowed an attacker to exploit the predictable state parameter, manipulating user sessions. The release of version 7.2.0 introduces a crucial update by generating a unique state parameter for each user, enhancing security by storing it in a cookie with HTTP-only and SameSite=Lax attributes. This change not only bolsters protection against CSRF but also introduces breaking changes to how the checkStateFunction operates, now accepting the full Request object for better validation.

References