CVE-2026-66885

Name of the Vulnerable Software and Affected Versions livebook versions 0.15.0 through 0.18.6 livebook versions 0.19.0 through 0.19.8

Description A Cross-Site Request Forgery (CSRF) issue exists when Livebook is configured to use Livebook Teams for identity. The handle request/4 function in lib/livebook/zta/livebook teams.ex processes OAuth-style callbacks containing a teams identity marker and a code parameter. Because the create auth request/1 function in lib/livebook/teams/requests.ex does not generate a state or nonce, the system fails to verify if the callback corresponds to the session that initiated the login.

An attacker within the same Livebook Teams organization can initiate a login flow, capture the authorization code, and trick a victim into opening a URL containing that code. This causes the victim's session to be bound to the attacker's identity. Consequently, any work, secrets, or data produced by the victim are attributed to and accessible by the attacker, while the victim believes they are using their own account.

Recommendations Update livebook versions 0.15.0 through 0.18.6 to version 0.18.7. Update livebook versions 0.19.0 through 0.19.8 to version 0.19.9.