CVE-2025-68481

Published: Dic 19, 2025 Last Modified: Mar 05, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 5,9
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: required
Scope: unchanged
Confidentiality: high
Integrity: low
Availability: none

Description

AI Translation Available

FastAPI Users allows users to quickly add a registration and authentication system to their FastAPI project. Prior to version 15.0.2, the OAuth login state tokens are completely stateless and carry no per-request entropy or any data that could link them to the session that initiated the OAuth flow. `generate_state_token()` is always called with an empty `state_data` dict, so the resulting JWT only contains the fixed audience claim plus an expiration timestamp. On callback, the library merely checks that the JWT verifies under `state_secret` and is unexpired; there is no attempt to match the state value to the browser that initiated the OAuth request, no correlation cookie, and no server-side cache. Any attacker can hit `/authorize`, capture the server-generated state, finish the upstream OAuth flow with their own provider account, and then trick a victim into loading `.../callback?code=<attacker_code>&state=<attacker_state>`. Because the state JWT is valid for any client for \~1 hour, the victim’s browser will complete the flow. This leads to login CSRF. Depending on the app’s logic, the login CSRF can lead to an account takeover of the victim account or to the victim user getting logged in to the attacker's account. Version 15.0.2 contains a patch for the issue.

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score
0,0002
Percentile
0,1th
Updated

EPSS Score Trend (Last 87 Days)

285

Improper Authorization

Draft
Abstraction: Class Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality Integrity Access Control
Potential Impacts:
Read Application Data Read Files Or Directories Modify Application Data Modify Files Or Directories Gain Privileges Or Assume Identity Execute Unauthorized Code Or Commands
Applicable Platforms
Technologies: Database Server, Not Technology-Specific, Web Server
Likelihood of Exploit: High
View CWE Details
352

Cross-Site Request Forgery (CSRF)

Stable
Abstraction: Compound Structure: Composite
Common Consequences
Security Scopes Affected:
Confidentiality Integrity Availability Non-Repudiation Access Control
Potential Impacts:
Gain Privileges Or Assume Identity Bypass Protection Mechanism Read Application Data Modify Application Data Dos: Crash, Exit, Or Restart
Applicable Platforms
Technologies: Web Based, Web Server
Likelihood of Exploit: Medium
View CWE Details
Application

Fastapi Users by Fastapi-Users Project

Product Information
Vendor Fastapi-Users Project
Product Fastapi Users
Version Range Affected
To 15.0.2 (exclusive)
cpe:2.3:a:fastapi-users_project:fastapi_users:*:*:*:*:*:python:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://github.com/fastapi-users/fastapi-users/blob/bcee8c9…
https://github.com/fastapi-users/fastapi-users/blob/bcee8c9b884de31decb5d799aea…
https://github.com/fastapi-users/fastapi-users/blob/bcee8c9…
https://github.com/fastapi-users/fastapi-users/blob/bcee8c9b884de31decb5d799aea…
https://github.com/fastapi-users/fastapi-users/commit/7cf41…
https://github.com/fastapi-users/fastapi-users/commit/7cf413cd766b9cb0ab323ce42…
https://github.com/fastapi-users/fastapi-users/security/adv…
https://github.com/fastapi-users/fastapi-users/security/advisories/GHSA-5j53-63…