Listen to this Post
How the Mentioned CVE Works:
The vulnerability exists in the `FrameworkIntegration` class when a shared cache (like Redis or Memcached) is configured for OAuth state storage. During an OAuth flow, the `set_state_data` method writes state data to a cache key formatted as `_state_{app}_{state}` without incorporating the user’s session identifier. The corresponding `get_state_data` method retrieves this state based solely on the provided `state` parameter, ignoring the caller’s session context. This design flaw breaks the binding between the OAuth state and the user session that initiated the request. An attacker can start an OAuth flow to obtain a valid `state` value and its associated authorization code. If the attacker tricks a victim into triggering the OAuth callback with this attacker-controlled `state` (e.g., via a phishing link), the application’s `authorize_access_token` function will retrieve the attacker’s state data from the shared cache. The application then exchanges the attacker’s authorization code for an access token within the victim’s active session. If the application links the new OAuth identity to the existing user account, this results in a full account takeover, as the attacker’s external account becomes permanently connected to the victim’s local account.
dailycve form:
Platform: Authlib
Version: Commit 260d04edee
Vulnerability: CSRF Account Takeover
Severity: Medium
date: 2026-01-09
Prediction: 2026-02-20
What Undercode Say:
Analytics:
`grep -r “FrameworkIntegration” .`
`python -c “import authlib; print(authlib.__version__)”`
`curl -s “http://localhost/oauth/callback?state=
How Exploit:
- Attacker initiates a legitimate OAuth login to the target application (e.g., “AwesomeAuthlibApp”) and pauses before the final callback.
- Attractor crafts a malicious URL containing their obtained `state` and `code` parameters pointing to the application’s OAuth callback endpoint.
- Victim (already logged into AwesomeAuthlibApp) is tricked into visiting the malicious URL via phishing or a malicious site.
- Application processes the callback, retrieves the attacker’s state from the shared cache using
get_state_data(session, attacker_state), and completes the token exchange. - Application links the attacker’s OAuth identity to the victim’s existing account, completing the takeover.
Protection from this CVE:
Modify `set_state_data` and `get_state_data` to include a session-derived component (like a hash of the session ID) in the cache key.
Fall back to session storage even when a global cache is configured, as suggested in the RFC.
Implement strict session binding for the OAuth state parameter as mandated by OAuth RFC 6749 Section 10.12.
Impact:
Full Account Takeover
Unauthorized Account Linking
Data Breach & Privacy Loss
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
