THREAT OPS › Threat News › [NVD] CVE-2026-59713 (HIGH 8.1) — Leantime contains an OIDC login CSRF vulnerability in the verifyState() method that unconditionally returns true without validating state parameters. Attackers can craft malicious callback URLs with attacker-controlled authorization codes to perform session fixation, logging vict
[NVD] CVE-2026-59713 (HIGH 8.1) — Leantime contains an OIDC login CSRF vulnerability in the verifyState() method that unconditionally returns true without validating state parameters. Attackers can craft malicious callback URLs with attacker-controlled authorization codes to perform session fixation, logging vict
CVE-2026-59713 CVSS: 8.1 HIGH Published: 2026-07-06T21:16:58.930
Leantime contains an OIDC login CSRF vulnerability in the verifyState() method that unconditionally returns true without validating state parameters. Attackers can craft malicious callback URLs with attacker-controlled authorization codes to perform session fixation, logging victims in as the attacker.
Indicators of compromise
- CVE-2026-59713cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-59713