An issue exists where the software fails to validate the OAuth state parameter against the stored nonce when using cookie-backed state storage without PKCE (Proof Key for Code Exchange). In the `parseGenericState` function, the cookie branch decrypted the `oauth state` cookie and validated expiry but did not compare the incoming OAuth `state` query parameter to the nonce issued at sign-in. This allows attackers to forge the `state` parameter and provide an attacker-controlled authorization code to the `/api/auth/oauth2/callback/<providerId>` endpoint. This can lead to forced-login (CSRF on OAuth callback), where a victim's browser is placed into a session bound to the attacker's external identity, or persistent account linking, where an attacker's external account is bound to the victim's authenticated profile.