Vulnerability-Lookup

CVE-2025-68481 (GCVE-0-2025-68481)

Vulnerability from cvelistv5 – Published: 2025-12-19 20:14 – Updated: 2025-12-19 20:40

Title

FastAPI Users Vulnerable to 1-click Account Takeover in Apps Using FastAPI SSO

Summary

FastAPI Users allows users to quickly add a registration and authentication system to their FastAPI project. Prior to version 15.0.2, the OAuth login state tokens are completely stateless and carry no per-request entropy or any data that could link them to the session that initiated the OAuth flow. `generate_state_token()` is always called with an empty `state_data` dict, so the resulting JWT only contains the fixed audience claim plus an expiration timestamp. On callback, the library merely checks that the JWT verifies under `state_secret` and is unexpired; there is no attempt to match the state value to the browser that initiated the OAuth request, no correlation cookie, and no server-side cache. Any attacker can hit `/authorize`, capture the server-generated state, finish the upstream OAuth flow with their own provider account, and then trick a victim into loading `.../callback?code=<attacker_code>&state=<attacker_state>`. Because the state JWT is valid for any client for \~1 hour, the victim’s browser will complete the flow. This leads to login CSRF. Depending on the app’s logic, the login CSRF can lead to an account takeover of the victim account or to the victim user getting logged in to the attacker's account. Version 15.0.2 contains a patch for the issue.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-12-19 20:39 UTC

CWE

CWE-285 - Improper Authorization
CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7761 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/fastapi-users/fastapi-users/se…	x_refsource_CONFIRM
https://github.com/fastapi-users/fastapi-users/co…	x_refsource_MISC
https://github.com/fastapi-users/fastapi-users/bl…	x_refsource_MISC
https://github.com/fastapi-users/fastapi-users/bl…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
fastapi-users	fastapi-users	Affected: < 15.0.2	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-68481",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-19T20:39:12.855569Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-19T20:40:18.988Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "fastapi-users",
          "vendor": "fastapi-users",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 15.0.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FastAPI Users allows users to quickly add a registration and authentication system to their FastAPI project. Prior to version 15.0.2, the OAuth login state tokens are completely stateless and carry no per-request entropy or any data that could link them to the session that initiated the OAuth flow. `generate_state_token()` is always called with an empty `state_data` dict, so the resulting JWT only contains the fixed audience claim plus an expiration timestamp. On callback, the library merely checks that the JWT verifies under `state_secret` and is unexpired; there is no attempt to match the state value to the browser that initiated the OAuth request, no correlation cookie, and no server-side cache. Any attacker can hit `/authorize`, capture the server-generated state, finish the upstream OAuth flow with their own provider account, and then trick a victim into loading `.../callback?code=\u003cattacker_code\u003e\u0026state=\u003cattacker_state\u003e`. Because the state JWT is valid for any client for \\~1 hour, the victim\u2019s browser will complete the flow. This leads to login CSRF. Depending on the app\u2019s logic, the login CSRF can lead to an account takeover of the victim account or to the victim user getting logged in to the attacker\u0027s account. Version 15.0.2 contains a patch for the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352: Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-19T20:14:07.636Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/fastapi-users/fastapi-users/security/advisories/GHSA-5j53-63w8-8625",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/fastapi-users/fastapi-users/security/advisories/GHSA-5j53-63w8-8625"
        },
        {
          "name": "https://github.com/fastapi-users/fastapi-users/commit/7cf413cd766b9cb0ab323ce424ddab2c0d235932",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fastapi-users/fastapi-users/commit/7cf413cd766b9cb0ab323ce424ddab2c0d235932"
        },
        {
          "name": "https://github.com/fastapi-users/fastapi-users/blob/bcee8c9b884de31decb5d799aead3974a0b5b158/fastapi_users/router/oauth.py#L111",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fastapi-users/fastapi-users/blob/bcee8c9b884de31decb5d799aead3974a0b5b158/fastapi_users/router/oauth.py#L111"
        },
        {
          "name": "https://github.com/fastapi-users/fastapi-users/blob/bcee8c9b884de31decb5d799aead3974a0b5b158/fastapi_users/router/oauth.py#L57",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fastapi-users/fastapi-users/blob/bcee8c9b884de31decb5d799aead3974a0b5b158/fastapi_users/router/oauth.py#L57"
        }
      ],
      "source": {
        "advisory": "GHSA-5j53-63w8-8625",
        "discovery": "UNKNOWN"
      },
      "title": "FastAPI Users Vulnerable to 1-click Account Takeover in Apps Using FastAPI SSO"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-68481",
    "datePublished": "2025-12-19T20:14:07.636Z",
    "dateReserved": "2025-12-18T18:29:07.309Z",
    "dateUpdated": "2025-12-19T20:40:18.988Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-68481",
      "date": "2026-10-24",
      "epss": "0.00258",
      "percentile": "0.16616"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "fastapi-users",
                "vendor": "fastapi-users",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 15.0.2"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:fastapi-users_project:fastapi_users:*:*:*:*:*:python:*:*",
                    "matchCriteriaId": "DF422B5A-1DB6-4A93-959D-6D6CA728DCBC",
                    "versionEndExcluding": "15.0.2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "FastAPI Users allows users to quickly add a registration and authentication system to their FastAPI project. Prior to version 15.0.2, the OAuth login state tokens are completely stateless and carry no per-request entropy or any data that could link them to the session that initiated the OAuth flow. `generate_state_token()` is always called with an empty `state_data` dict, so the resulting JWT only contains the fixed audience claim plus an expiration timestamp. On callback, the library merely checks that the JWT verifies under `state_secret` and is unexpired; there is no attempt to match the state value to the browser that initiated the OAuth request, no correlation cookie, and no server-side cache. Any attacker can hit `/authorize`, capture the server-generated state, finish the upstream OAuth flow with their own provider account, and then trick a victim into loading `.../callback?code=\u003cattacker_code\u003e\u0026state=\u003cattacker_state\u003e`. Because the state JWT is valid for any client for \\~1 hour, the victim\u2019s browser will complete the flow. This leads to login CSRF. Depending on the app\u2019s logic, the login CSRF can lead to an account takeover of the victim account or to the victim user getting logged in to the attacker\u0027s account. Version 15.0.2 contains a patch for the issue."
          },
          {
            "lang": "es",
            "value": "FastAPI Users permite a los usuarios a\u00f1adir r\u00e1pidamente un sistema de registro y autenticaci\u00f3n a su proyecto FastAPI. Antes de la versi\u00f3n 15.0.2, los tokens de estado de inicio de sesi\u00f3n de OAuth son completamente sin estado y no llevan entrop\u00eda por solicitud ni ning\u00fan dato que pueda vincularlos a la sesi\u00f3n que inici\u00f3 el flujo de OAuth. \u0027generate_state_token()\u0027 siempre se llama con un diccionario \u0027state_data\u0027 vac\u00edo, por lo que el JWT resultante solo contiene la declaraci\u00f3n de audiencia fija m\u00e1s una marca de tiempo de expiraci\u00f3n. En la devoluci\u00f3n de llamada, la biblioteca simplemente verifica que el JWT se valida bajo \u0027state_secret\u0027 y no ha expirado; no hay ning\u00fan intento de hacer coincidir el valor de estado con el navegador que inici\u00f3 la solicitud de OAuth, ninguna cookie de correlaci\u00f3n y ninguna cach\u00e9 del servidor. Cualquier atacante puede acceder a \u0027/authorize\u0027, capturar el estado generado por el servidor, finalizar el flujo de OAuth ascendente con su propia cuenta de proveedor y luego enga\u00f1ar a una v\u00edctima para que cargue \u0027.../callback?code=\u003cattacker_code\u003e\u0026state=\u003cattacker_state\u003e\u0027. Debido a que el JWT de estado es v\u00e1lido para cualquier cliente durante ~1 hora, el navegador de la v\u00edctima completar\u00e1 el flujo. Esto conduce a CSRF de inicio de sesi\u00f3n. Dependiendo de la l\u00f3gica de la aplicaci\u00f3n, el CSRF de inicio de sesi\u00f3n puede llevar a una toma de control de la cuenta de la v\u00edctima o a que el usuario v\u00edctima inicie sesi\u00f3n en la cuenta del atacante. La versi\u00f3n 15.0.2 contiene un parche para el problema."
          }
        ],
        "id": "CVE-2025-68481",
        "lastModified": "2026-10-13T11:10:00.203",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.9,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 1.6,
              "impactScore": 4.2,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-68481",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-19T20:39:12.855569Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-12-19T21:15:54.823",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Product"
            ],
            "url": "https://github.com/fastapi-users/fastapi-users/blob/bcee8c9b884de31decb5d799aead3974a0b5b158/fastapi_users/router/oauth.py#L111"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Product"
            ],
            "url": "https://github.com/fastapi-users/fastapi-users/blob/bcee8c9b884de31decb5d799aead3974a0b5b158/fastapi_users/router/oauth.py#L57"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/fastapi-users/fastapi-users/commit/7cf413cd766b9cb0ab323ce424ddab2c0d235932"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Exploit",
              "Vendor Advisory"
            ],
            "url": "https://github.com/fastapi-users/fastapi-users/security/advisories/GHSA-5j53-63w8-8625"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-285"
              },
              {
                "lang": "en",
                "value": "CWE-352"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-12-20T20:14:24+00:00",
      "cve": "CVE-2025-68481",
      "id": "CVE-2025-68481",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "FastAPI Users Vulnerable to 1-click Account Takeover in Apps Using FastAPI SSO",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68481.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-68481",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-12-19T20:39:12.855569Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-12-19T20:39:32.775Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "fastapi-users",
              "vendor": "fastapi-users",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 15.0.2"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "FastAPI Users allows users to quickly add a registration and authentication system to their FastAPI project. Prior to version 15.0.2, the OAuth login state tokens are completely stateless and carry no per-request entropy or any data that could link them to the session that initiated the OAuth flow. `generate_state_token()` is always called with an empty `state_data` dict, so the resulting JWT only contains the fixed audience claim plus an expiration timestamp. On callback, the library merely checks that the JWT verifies under `state_secret` and is unexpired; there is no attempt to match the state value to the browser that initiated the OAuth request, no correlation cookie, and no server-side cache. Any attacker can hit `/authorize`, capture the server-generated state, finish the upstream OAuth flow with their own provider account, and then trick a victim into loading `.../callback?code=\u003cattacker_code\u003e\u0026state=\u003cattacker_state\u003e`. Because the state JWT is valid for any client for \\~1 hour, the victim\u2019s browser will complete the flow. This leads to login CSRF. Depending on the app\u2019s logic, the login CSRF can lead to an account takeover of the victim account or to the victim user getting logged in to the attacker\u0027s account. Version 15.0.2 contains a patch for the issue."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.9,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-285",
                  "description": "CWE-285: Improper Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-352",
                  "description": "CWE-352: Cross-Site Request Forgery (CSRF)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-12-19T20:14:07.636Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/fastapi-users/fastapi-users/security/advisories/GHSA-5j53-63w8-8625",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/fastapi-users/fastapi-users/security/advisories/GHSA-5j53-63w8-8625"
            },
            {
              "name": "https://github.com/fastapi-users/fastapi-users/commit/7cf413cd766b9cb0ab323ce424ddab2c0d235932",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/fastapi-users/fastapi-users/commit/7cf413cd766b9cb0ab323ce424ddab2c0d235932"
            },
            {
              "name": "https://github.com/fastapi-users/fastapi-users/blob/bcee8c9b884de31decb5d799aead3974a0b5b158/fastapi_users/router/oauth.py#L111",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/fastapi-users/fastapi-users/blob/bcee8c9b884de31decb5d799aead3974a0b5b158/fastapi_users/router/oauth.py#L111"
            },
            {
              "name": "https://github.com/fastapi-users/fastapi-users/blob/bcee8c9b884de31decb5d799aead3974a0b5b158/fastapi_users/router/oauth.py#L57",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/fastapi-users/fastapi-users/blob/bcee8c9b884de31decb5d799aead3974a0b5b158/fastapi_users/router/oauth.py#L57"
            }
          ],
          "source": {
            "advisory": "GHSA-5j53-63w8-8625",
            "discovery": "UNKNOWN"
          },
          "title": "FastAPI Users Vulnerable to 1-click Account Takeover in Apps Using FastAPI SSO"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2025-68481",
        "datePublished": "2025-12-19T20:14:07.636Z",
        "dateReserved": "2025-12-18T18:29:07.309Z",
        "dateUpdated": "2025-12-19T20:40:18.988Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2025-68481

Vulnerability from fkie_nvd - Published: 2025-12-19 21:15 - Updated: 2026-10-13 11:10

Severity

5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/fastapi-users/fastapi-users/blob/bcee8c9b884de31decb5d799aead3974a0b5b158/fastapi_users/router/oauth.py#L111	Product
security-advisories@github.com	https://github.com/fastapi-users/fastapi-users/blob/bcee8c9b884de31decb5d799aead3974a0b5b158/fastapi_users/router/oauth.py#L57	Product
security-advisories@github.com	https://github.com/fastapi-users/fastapi-users/commit/7cf413cd766b9cb0ab323ce424ddab2c0d235932	Patch
security-advisories@github.com	https://github.com/fastapi-users/fastapi-users/security/advisories/GHSA-5j53-63w8-8625	Exploit, Vendor Advisory

Impacted products

	Vendor	Product	Version
	fastapi-users_project	fastapi_users	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "fastapi-users",
          "vendor": "fastapi-users",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 15.0.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fastapi-users_project:fastapi_users:*:*:*:*:*:python:*:*",
              "matchCriteriaId": "DF422B5A-1DB6-4A93-959D-6D6CA728DCBC",
              "versionEndExcluding": "15.0.2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "FastAPI Users allows users to quickly add a registration and authentication system to their FastAPI project. Prior to version 15.0.2, the OAuth login state tokens are completely stateless and carry no per-request entropy or any data that could link them to the session that initiated the OAuth flow. `generate_state_token()` is always called with an empty `state_data` dict, so the resulting JWT only contains the fixed audience claim plus an expiration timestamp. On callback, the library merely checks that the JWT verifies under `state_secret` and is unexpired; there is no attempt to match the state value to the browser that initiated the OAuth request, no correlation cookie, and no server-side cache. Any attacker can hit `/authorize`, capture the server-generated state, finish the upstream OAuth flow with their own provider account, and then trick a victim into loading `.../callback?code=\u003cattacker_code\u003e\u0026state=\u003cattacker_state\u003e`. Because the state JWT is valid for any client for \\~1 hour, the victim\u2019s browser will complete the flow. This leads to login CSRF. Depending on the app\u2019s logic, the login CSRF can lead to an account takeover of the victim account or to the victim user getting logged in to the attacker\u0027s account. Version 15.0.2 contains a patch for the issue."
    },
    {
      "lang": "es",
      "value": "FastAPI Users permite a los usuarios a\u00f1adir r\u00e1pidamente un sistema de registro y autenticaci\u00f3n a su proyecto FastAPI. Antes de la versi\u00f3n 15.0.2, los tokens de estado de inicio de sesi\u00f3n de OAuth son completamente sin estado y no llevan entrop\u00eda por solicitud ni ning\u00fan dato que pueda vincularlos a la sesi\u00f3n que inici\u00f3 el flujo de OAuth. \u0027generate_state_token()\u0027 siempre se llama con un diccionario \u0027state_data\u0027 vac\u00edo, por lo que el JWT resultante solo contiene la declaraci\u00f3n de audiencia fija m\u00e1s una marca de tiempo de expiraci\u00f3n. En la devoluci\u00f3n de llamada, la biblioteca simplemente verifica que el JWT se valida bajo \u0027state_secret\u0027 y no ha expirado; no hay ning\u00fan intento de hacer coincidir el valor de estado con el navegador que inici\u00f3 la solicitud de OAuth, ninguna cookie de correlaci\u00f3n y ninguna cach\u00e9 del servidor. Cualquier atacante puede acceder a \u0027/authorize\u0027, capturar el estado generado por el servidor, finalizar el flujo de OAuth ascendente con su propia cuenta de proveedor y luego enga\u00f1ar a una v\u00edctima para que cargue \u0027.../callback?code=\u003cattacker_code\u003e\u0026state=\u003cattacker_state\u003e\u0027. Debido a que el JWT de estado es v\u00e1lido para cualquier cliente durante ~1 hora, el navegador de la v\u00edctima completar\u00e1 el flujo. Esto conduce a CSRF de inicio de sesi\u00f3n. Dependiendo de la l\u00f3gica de la aplicaci\u00f3n, el CSRF de inicio de sesi\u00f3n puede llevar a una toma de control de la cuenta de la v\u00edctima o a que el usuario v\u00edctima inicie sesi\u00f3n en la cuenta del atacante. La versi\u00f3n 15.0.2 contiene un parche para el problema."
    }
  ],
  "id": "CVE-2025-68481",
  "lastModified": "2026-10-13T11:10:00.203",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 4.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-68481",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-12-19T20:39:12.855569Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-12-19T21:15:54.823",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Product"
      ],
      "url": "https://github.com/fastapi-users/fastapi-users/blob/bcee8c9b884de31decb5d799aead3974a0b5b158/fastapi_users/router/oauth.py#L111"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Product"
      ],
      "url": "https://github.com/fastapi-users/fastapi-users/blob/bcee8c9b884de31decb5d799aead3974a0b5b158/fastapi_users/router/oauth.py#L57"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/fastapi-users/fastapi-users/commit/7cf413cd766b9cb0ab323ce424ddab2c0d235932"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/fastapi-users/fastapi-users/security/advisories/GHSA-5j53-63w8-8625"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-285"
        },
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-5J53-63W8-8625

Vulnerability from github – Published: 2025-12-19 21:10 – Updated: 2025-12-20 05:46

Summary

FastAPI Users Vulnerable to 1-click Account Takeover in Apps Using FastAPI SSO

Details

Description

The OAuth login state tokens are completely stateless and carry no per-request entropy or any data that could link them to the session that initiated the OAuth flow. generate_state_token() is always called with an empty state_data dict, so the resulting JWT only contains the fixed audience claim plus an expiration timestamp. [1]

        state_data: dict[str, str] = {}
        state = generate_state_token(state_data, state_secret)
        authorization_url = await oauth_client.get_authorization_url(
            authorize_redirect_url,
            state,
            scopes,
        )

fastapi_users/router/oauth.py:65-71

On callback, the library merely checks that the JWT verifies under state_secret and is unexpired; there is no attempt to match the state value to the browser that initiated the OAuth request, no correlation cookie, and no server-side cache. [2]

        try:
            decode_jwt(state, state_secret, [STATE_TOKEN_AUDIENCE])
        except jwt.DecodeError:
            raise HTTPException(
                status_code=status.HTTP_400_BAD_REQUEST,
                detail=ErrorCode.ACCESS_TOKEN_DECODE_ERROR,
            )
        except jwt.ExpiredSignatureError:
            raise HTTPException(
                status_code=status.HTTP_400_BAD_REQUEST,
                detail=ErrorCode.ACCESS_TOKEN_ALREADY_EXPIRED,
            )

fastapi_users/router/oauth.py:130-141

Any attacker can hit /authorize, capture the server-generated state, finish the upstream OAuth flow with their own provider account, and then trick a victim into loading .../callback?code=<attacker_code>&state=<attacker_state>. Because the state JWT is valid for any client for \~1 hour, the victim’s browser will complete the flow. This leads to login CSRF. Depending on the app’s logic, the login CSRF can lead to an account takeover of the victim account or to the victim user getting logged in to the attacker's account.

[1] https://github.com/fastapi-users/fastapi-users/blob/bcee8c9b884de31decb5d799aead3974a0b5b158/fastapi_users/router/oauth.py#L57

[2]
https://github.com/fastapi-users/fastapi-users/blob/bcee8c9b884de31decb5d799aead3974a0b5b158/fastapi_users/router/oauth.py#L111

Proof of Concept

Let’s think of an app - AwesomeFastAPIApp. Let’s assume that the AwesomeFastAPIApp has internal logic that uses a UserManager different from the default BaseUserManager. With this manager, when an already logged-in user performs a callback request, the newly provided SSO identity gets linked to the already existing user that made the request.

Then, an attacker can get account takeover inside the app by performing the following actions:

1. They start an SSO OAuth flow, but stop it right before making the callback call to AwesomeFastAPIApp;
2. The attacker tricks a logged-in user (via phishing, a drive-by attack, etc.) to perform a GET request with the attacker's state value and grant code to the AwesomeFastAPIApp callback. Because the library doesn’t check whether the state token is linked to the session performing the callback, the callback is processed, the grant code is sent to the provider, and the account linking takes place.

After the GET request is performed, the attacker's SSO account is linked with the victim's AwesomeFastAPIApp account permanently.

Suggested Fix

Make the state a value tied to the session of the user that initiated the OAuth flow, as recommended by the official RFC. [3]

[3] https://www.rfc-editor.org/rfc/rfc6749#section-10.12

Severity

5.9 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "fastapi-users"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "15.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-68481"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-285",
      "CWE-352"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-12-19T21:10:40Z",
    "nvd_published_at": "2025-12-19T21:15:54Z",
    "severity": "MODERATE"
  },
  "details": "**Description**\n\nThe OAuth login state tokens are completely stateless and carry no per-request entropy or any data that could link them to the session that initiated the OAuth flow. `generate_state_token()` is always called with an empty `state_data` dict, so the resulting JWT only contains the fixed audience claim plus an expiration timestamp. \\[1\\]\n\n```py\n        state_data: dict[str, str] = {}\n        state = generate_state_token(state_data, state_secret)\n        authorization_url = await oauth_client.get_authorization_url(\n            authorize_redirect_url,\n            state,\n            scopes,\n        )\n```\n\n*fastapi\\_users/router/oauth.py:65-71*\n\nOn callback, the library merely checks that the JWT verifies under `state_secret` and is unexpired; there is no attempt to match the state value to the browser that initiated the OAuth request, no correlation cookie, and no server-side cache. \\[2\\]\n\n```py\n        try:\n            decode_jwt(state, state_secret, [STATE_TOKEN_AUDIENCE])\n        except jwt.DecodeError:\n            raise HTTPException(\n                status_code=status.HTTP_400_BAD_REQUEST,\n                detail=ErrorCode.ACCESS_TOKEN_DECODE_ERROR,\n            )\n        except jwt.ExpiredSignatureError:\n            raise HTTPException(\n                status_code=status.HTTP_400_BAD_REQUEST,\n                detail=ErrorCode.ACCESS_TOKEN_ALREADY_EXPIRED,\n            )\n```\n\n*fastapi\\_users/router/oauth.py:130-141*\n\nAny attacker can hit `/authorize`, capture the server-generated state, finish the upstream OAuth flow with their own provider account, and then trick a victim into loading `.../callback?code=\u003cattacker_code\u003e\u0026state=\u003cattacker_state\u003e`. Because the state JWT is valid for any client for \\~1 hour, the victim\u2019s browser will complete the flow. This leads to login CSRF. Depending on the app\u2019s logic, the login CSRF can lead to an account takeover of the victim account or to the victim user getting logged in to the attacker\u0027s account.\n\n\\[1\\] [https://github.com/fastapi-users/fastapi-users/blob/bcee8c9b884de31decb5d799aead3974a0b5b158/fastapi\\_users/router/oauth.py\\#L57](https://github.com/fastapi-users/fastapi-users/blob/bcee8c9b884de31decb5d799aead3974a0b5b158/fastapi_users/router/oauth.py#L57)\n\n\\[2\\]  \n[https://github.com/fastapi-users/fastapi-users/blob/bcee8c9b884de31decb5d799aead3974a0b5b158/fastapi\\_users/router/oauth.py\\#L111](https://github.com/fastapi-users/fastapi-users/blob/bcee8c9b884de31decb5d799aead3974a0b5b158/fastapi_users/router/oauth.py#L111)\n\n**Proof of Concept**\n\nLet\u2019s think of an app \\- AwesomeFastAPIApp. Let\u2019s assume that the AwesomeFastAPIApp has internal logic that uses a `UserManager` different from the default `BaseUserManager.` With this `manager,` when an already logged-in user performs a callback request,  the newly provided SSO identity gets linked to the already existing user that made the request.\n\nThen, an attacker can get account takeover inside the app by performing the following actions:\n\n1\\. They start an SSO OAuth flow, but stop it right before making the callback call to AwesomeFastAPIApp;  \n2\\. The attacker tricks a logged-in user (via phishing, a drive-by attack, etc.) to perform a GET request with the attacker\u0027s state value and grant code to the AwesomeFastAPIApp callback. Because the library doesn\u2019t check whether the state token is linked to the session performing the callback, the callback is processed, the grant code is sent to the provider, and the account linking takes place.\n\nAfter the GET request is performed, the attacker\u0027s SSO account is linked with the victim\u0027s AwesomeFastAPIApp account permanently.\n\n**Suggested Fix**\n\nMake the state a value tied to the session of the user that initiated the OAuth flow, as recommended by the official RFC. \\[3\\]\n\n\n\\[3\\] [https://www.rfc-editor.org/rfc/rfc6749\\#section-10.12](https://www.rfc-editor.org/rfc/rfc6749#section-10.12)",
  "id": "GHSA-5j53-63w8-8625",
  "modified": "2025-12-20T05:46:19Z",
  "published": "2025-12-19T21:10:40Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/fastapi-users/fastapi-users/security/advisories/GHSA-5j53-63w8-8625"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68481"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fastapi-users/fastapi-users/commit/7cf413cd766b9cb0ab323ce424ddab2c0d235932"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/fastapi-users/fastapi-users"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fastapi-users/fastapi-users/blob/bcee8c9b884de31decb5d799aead3974a0b5b158/fastapi_users/router/oauth.py#L111"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fastapi-users/fastapi-users/blob/bcee8c9b884de31decb5d799aead3974a0b5b158/fastapi_users/router/oauth.py#L57"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "FastAPI Users Vulnerable to 1-click Account Takeover in Apps Using FastAPI SSO"
}

PYSEC-2026-1363

Vulnerability from pysec - Published: 2026-07-07 16:03 - Updated: 2026-07-07 17:24

Details

Description

        state_data: dict[str, str] = {}
        state = generate_state_token(state_data, state_secret)
        authorization_url = await oauth_client.get_authorization_url(
            authorize_redirect_url,
            state,
            scopes,
        )

fastapi_users/router/oauth.py:65-71

        try:
            decode_jwt(state, state_secret, [STATE_TOKEN_AUDIENCE])
        except jwt.DecodeError:
            raise HTTPException(
                status_code=status.HTTP_400_BAD_REQUEST,
                detail=ErrorCode.ACCESS_TOKEN_DECODE_ERROR,
            )
        except jwt.ExpiredSignatureError:
            raise HTTPException(
                status_code=status.HTTP_400_BAD_REQUEST,
                detail=ErrorCode.ACCESS_TOKEN_ALREADY_EXPIRED,
            )

fastapi_users/router/oauth.py:130-141

[1] https://github.com/fastapi-users/fastapi-users/blob/bcee8c9b884de31decb5d799aead3974a0b5b158/fastapi_users/router/oauth.py#L57

[2]
https://github.com/fastapi-users/fastapi-users/blob/bcee8c9b884de31decb5d799aead3974a0b5b158/fastapi_users/router/oauth.py#L111

Proof of Concept

Then, an attacker can get account takeover inside the app by performing the following actions:

After the GET request is performed, the attacker's SSO account is linked with the victim's AwesomeFastAPIApp account permanently.

Suggested Fix

Make the state a value tied to the session of the user that initiated the OAuth flow, as recommended by the official RFC. [3]

[3] https://www.rfc-editor.org/rfc/rfc6749#section-10.12

Severity

5.9 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N

Impacted products

Name	purl
fastapi-users	pkg:pypi/fastapi-users

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "fastapi-users",
        "purl": "pkg:pypi/fastapi-users"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "15.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.0.2",
        "0.1.0",
        "0.2.0",
        "0.3.0",
        "0.3.1",
        "0.3.2",
        "0.4.0",
        "0.4.1",
        "0.5.0",
        "0.5.1",
        "0.6.0",
        "0.6.1",
        "0.6.2",
        "0.6.3",
        "0.6.4",
        "0.6.5",
        "0.6.6",
        "0.7.0",
        "0.7.1",
        "0.7.2",
        "0.7.3",
        "0.8.0",
        "0.8.1",
        "1.0.0",
        "1.1.0",
        "1.1.1",
        "10.0.0",
        "10.0.1",
        "10.0.2",
        "10.0.3",
        "10.0.4",
        "10.0.5",
        "10.0.6",
        "10.0.7",
        "10.1.0",
        "10.1.1",
        "10.1.2",
        "10.1.3",
        "10.1.4",
        "10.1.5",
        "10.2.0",
        "10.2.1",
        "10.3.0",
        "10.4.0",
        "10.4.1",
        "10.4.2",
        "11.0.0",
        "12.0.0",
        "12.1.0",
        "12.1.1",
        "12.1.2",
        "12.1.3",
        "13.0.0",
        "14.0.0",
        "14.0.1",
        "14.0.2",
        "15.0.0",
        "15.0.1",
        "2.0.0",
        "2.0.1",
        "3.0.0",
        "3.0.1",
        "3.0.2",
        "3.0.3",
        "3.0.4",
        "3.0.5",
        "3.0.6",
        "3.0.7",
        "3.1.0",
        "3.1.1",
        "3.1.2",
        "4.0.0",
        "5.0.0",
        "5.1.0",
        "5.1.1",
        "5.1.2",
        "5.1.3",
        "5.1.4",
        "6.0.0",
        "6.1.0",
        "6.1.1",
        "6.1.2",
        "6.1.3",
        "7.0.0",
        "8.0.0",
        "8.0.0b1",
        "8.0.0b2",
        "8.0.0b3",
        "8.1.0",
        "8.1.1",
        "8.1.2",
        "8.1.3",
        "8.1.4",
        "8.1.5",
        "9.0.0",
        "9.0.1",
        "9.1.0",
        "9.1.1",
        "9.2.0",
        "9.2.1",
        "9.2.2",
        "9.2.3",
        "9.2.4",
        "9.2.5",
        "9.2.6",
        "9.3.0",
        "9.3.1",
        "9.3.2"
      ]
    }
  ],
  "aliases": [
    "CVE-2025-68481",
    "GHSA-5j53-63w8-8625"
  ],
  "details": "**Description**\n\nThe OAuth login state tokens are completely stateless and carry no per-request entropy or any data that could link them to the session that initiated the OAuth flow. `generate_state_token()` is always called with an empty `state_data` dict, so the resulting JWT only contains the fixed audience claim plus an expiration timestamp. \\[1\\]\n\n```py\n        state_data: dict[str, str] = {}\n        state = generate_state_token(state_data, state_secret)\n        authorization_url = await oauth_client.get_authorization_url(\n            authorize_redirect_url,\n            state,\n            scopes,\n        )\n```\n\n*fastapi\\_users/router/oauth.py:65-71*\n\nOn callback, the library merely checks that the JWT verifies under `state_secret` and is unexpired; there is no attempt to match the state value to the browser that initiated the OAuth request, no correlation cookie, and no server-side cache. \\[2\\]\n\n```py\n        try:\n            decode_jwt(state, state_secret, [STATE_TOKEN_AUDIENCE])\n        except jwt.DecodeError:\n            raise HTTPException(\n                status_code=status.HTTP_400_BAD_REQUEST,\n                detail=ErrorCode.ACCESS_TOKEN_DECODE_ERROR,\n            )\n        except jwt.ExpiredSignatureError:\n            raise HTTPException(\n                status_code=status.HTTP_400_BAD_REQUEST,\n                detail=ErrorCode.ACCESS_TOKEN_ALREADY_EXPIRED,\n            )\n```\n\n*fastapi\\_users/router/oauth.py:130-141*\n\nAny attacker can hit `/authorize`, capture the server-generated state, finish the upstream OAuth flow with their own provider account, and then trick a victim into loading `.../callback?code=\u003cattacker_code\u003e\u0026state=\u003cattacker_state\u003e`. Because the state JWT is valid for any client for \\~1 hour, the victim\u2019s browser will complete the flow. This leads to login CSRF. Depending on the app\u2019s logic, the login CSRF can lead to an account takeover of the victim account or to the victim user getting logged in to the attacker\u0027s account.\n\n\\[1\\] [https://github.com/fastapi-users/fastapi-users/blob/bcee8c9b884de31decb5d799aead3974a0b5b158/fastapi\\_users/router/oauth.py\\#L57](https://github.com/fastapi-users/fastapi-users/blob/bcee8c9b884de31decb5d799aead3974a0b5b158/fastapi_users/router/oauth.py#L57)\n\n\\[2\\]  \n[https://github.com/fastapi-users/fastapi-users/blob/bcee8c9b884de31decb5d799aead3974a0b5b158/fastapi\\_users/router/oauth.py\\#L111](https://github.com/fastapi-users/fastapi-users/blob/bcee8c9b884de31decb5d799aead3974a0b5b158/fastapi_users/router/oauth.py#L111)\n\n**Proof of Concept**\n\nLet\u2019s think of an app \\- AwesomeFastAPIApp. Let\u2019s assume that the AwesomeFastAPIApp has internal logic that uses a `UserManager` different from the default `BaseUserManager.` With this `manager,` when an already logged-in user performs a callback request,  the newly provided SSO identity gets linked to the already existing user that made the request.\n\nThen, an attacker can get account takeover inside the app by performing the following actions:\n\n1\\. They start an SSO OAuth flow, but stop it right before making the callback call to AwesomeFastAPIApp;  \n2\\. The attacker tricks a logged-in user (via phishing, a drive-by attack, etc.) to perform a GET request with the attacker\u0027s state value and grant code to the AwesomeFastAPIApp callback. Because the library doesn\u2019t check whether the state token is linked to the session performing the callback, the callback is processed, the grant code is sent to the provider, and the account linking takes place.\n\nAfter the GET request is performed, the attacker\u0027s SSO account is linked with the victim\u0027s AwesomeFastAPIApp account permanently.\n\n**Suggested Fix**\n\nMake the state a value tied to the session of the user that initiated the OAuth flow, as recommended by the official RFC. \\[3\\]\n\n\n\\[3\\] [https://www.rfc-editor.org/rfc/rfc6749\\#section-10.12](https://www.rfc-editor.org/rfc/rfc6749#section-10.12)",
  "id": "PYSEC-2026-1363",
  "modified": "2026-07-07T17:24:07.719672Z",
  "published": "2026-07-07T16:03:13.791740Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/fastapi-users/fastapi-users/security/advisories/GHSA-5j53-63w8-8625"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68481"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fastapi-users/fastapi-users/commit/7cf413cd766b9cb0ab323ce424ddab2c0d235932"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/fastapi-users/fastapi-users"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fastapi-users/fastapi-users/blob/bcee8c9b884de31decb5d799aead3974a0b5b158/fastapi_users/router/oauth.py#L111"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fastapi-users/fastapi-users/blob/bcee8c9b884de31decb5d799aead3974a0b5b158/fastapi_users/router/oauth.py#L57"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/fastapi-users"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-5j53-63w8-8625"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "FastAPI Users Vulnerable to 1-click Account Takeover in Apps Using FastAPI SSO"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-68481 (GCVE-0-2025-68481)

FKIE_CVE-2025-68481

GHSA-5J53-63W8-8625

PYSEC-2026-1363

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour