CVE-2026-18165

Name of the Vulnerable Software and Affected Versions @fastify/oauth2 versions 7.2.0 through 8.2.x

Description This plugin validates the OAuth state and the PKCE code verifier by comparing the callback query parameter against an unprefixed, predictable cookie that lacks server-side binding to the browser that initiated the flow. An attacker capable of writing a cookie for the application's host, such as through a sibling subdomain, can plant matching state and verifier cookies. This allows the attacker to complete an OAuth flow within a victim's browser, silently signing the victim into the attacker's account, a process known as login CSRF (Cross-Site Request Forgery). This issue does not expose the victim's own account, credentials, or tokens.

Recommendations Update to version 8.3.0 and enable the hostPrefixedCookies option. Bind state to a server-side session.