Kleju13

**Name of the Vulnerable Software and Affected Versions** @fastify/oauth2 versions 7.2.0 through 8.2.x **Description** This plugin validates the OAuth state and the PKCE code verifier by comparing the callback query parameter against an unprefixed, predictable cookie that lacks server-side binding to the browser that initiated the flow. An attacker capable of writing a cookie for the application's host, such as through a sibling subdomain, can plant matching state and verifier cookies. This allows the attacker to complete an OAuth flow within a victim's browser, silently signing the victim into the attacker's account, a process known as login CSRF (Cross-Site Request Forgery). This issue does not expose the victim's own account, credentials, or tokens. **Recommendations** Update to version 8.3.0 and enable the `hostPrefixedCookies` option. Bind state to a server-side session.