OAuth 2.0 Plugin Vulnerability in Fastify by @fastify
CVE-2026-18165

4.2MEDIUM

Key Information:

Vendor

@fastify/oauth2

Status
@fastify/oauth2
Vendor
CVE Published:
15 August 2026

What is CVE-2026-18165?

The @fastify/oauth2 plugin for Fastify exhibits a vulnerability in versions prior to 8.3.0, where it improperly validates the OAuth state and PKCE code verifier. This flaw allows an attacker with the ability to set a cookie for the affected host to spoof the OAuth flow, leading to unauthorized authentication of users without compromising their credentials or tokens. The vulnerability can be mitigated by upgrading to version 8.3.0 and enabling the hostPrefixedCookies option or implementing server-side session binding.

Affected Version(s)

@fastify/oauth2 7.2.0 < 8.3.0

@fastify/oauth2 8.3.0

References

https://github.com/fastify/fastify-oauth2/security/adviso...
https://cna.openjsf.org/security-advisories.html

CVSS V3.1

Score:
4.2
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

kleju13
mcollina
UlisesGascon
.