CVE-2023-35935

Name of the Vulnerable Software and Affected Versions @fastify/oauth2 versions prior to 7.2.0

Description The issue is related to cross-site request forgery (CSRF) due to the use of a statically generated state parameter across all requests for all users. This parameter should be unique per user and connected to the user's session to prevent CSRF attacks. The default behavior has been changed in version 7.2.0 to store the state in a cookie with specific attributes and generate it for every user.

Recommendations For versions prior to 7.2.0, update to version 7.2.0 or later, which changes the default behavior to store the state in a cookie and generates it for every user. As a temporary workaround, consider implementing a custom solution to generate a unique state parameter for each user and store it in a secure manner, such as in a cookie with the http-only and same-site=lax attributes set.