CVE-2026-59713 — Leantime - OIDC Login CSRF via Unconditional State Verification Stub
Leantime contains an OIDC login CSRF vulnerability in the verifyState() method that unconditionally returns true without validating state parameters. Attackers can craft malicio…
Published: 2026-07-06 · CVSS: 8.6 · CVSS 4.0
Leantime contains an OIDC login CSRF vulnerability in the verifyState() method that unconditionally returns true without validating state parameters. Attackers can craft malicious callback URLs with attacker-controlled authorization codes to perform session fixation, logging victims in as the attacker.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7