CVE-2026-59713

Received Received - Intake

OIDC Login CSRF in Leantime

Publication date: 2026-07-06

Last updated on: 2026-07-06

Assigner: VulnCheck

Description

Leantime contains an OIDC login CSRF vulnerability in the verifyState() method that unconditionally returns true without validating state parameters. Attackers can craft malicious callback URLs with attacker-controlled authorization codes to perform session fixation, logging victims in as the attacker.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-06

Last Modified

2026-07-06

Generated

2026-07-07

AI Q&A

2026-07-07

EPSS Evaluated

N/A

NVD

CVE-2026-59713

Affected Vendors & Products

Vendor	Product	Version / Range
leantime	leantime	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

Leantime contains an OIDC login CSRF vulnerability in the verifyState() method that unconditionally returns true without validating state parameters.

This flaw allows attackers to craft malicious callback URLs with attacker-controlled authorization codes.

As a result, attackers can perform session fixation by logging victims in as the attacker.

Impact Analysis

This vulnerability can lead to session fixation attacks where an attacker forces a victim to use a session controlled by the attacker.

Victims may unknowingly be logged in as the attacker, potentially exposing sensitive information or allowing unauthorized actions under the victim's identity.

Hi! I’m here to help you understand CVE-2026-59713. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70