Cross-Site Request Forgery Vulnerability in FastAPI SSO by Tomas Votava

CVE-2025-14546

What is CVE-2025-14546?

Versions of FastAPI SSO prior to 0.19.0 exhibit a vulnerability related to Cross-site Request Forgery (CSRF). The issue stems from inadequate validation of the OAuth state parameter during the authentication callback process. The get_login_url method generates a state value; however, it fails to bind this value to the user's session, and the verify_and_process method does not validate the state parameter against a trusted value. This oversight allows an attacker to potentially redirect a victim to a malicious callback URL, thereby linking the attacker's account with the victim's internal account.

References