AIKIDO-2025-10127
remix-auth-oauth2 is vulnerable to Cross-Site Request Forgery (CSRF)
30
Low Risk
This Affects:
remix-auth-oauth2TL;DR
Affected versions of the package are vulnerable to Cross-site Request Forgery (CSRF) attacks due to improper validation of the state URL parameter. Without proper validation, attackers could exploit this flaw for CSRF or impersonation attacks. Similar issues have previously enabled phishing attempts by manipulating error messages. In recent updates, remix-auth-oauth2 moved state management from session storage to cookies, requiring earlier validation in the handler. This patch ensures that only legitimate OAuth2 requests proceed while unauthorized attempts trigger a generic error page.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
remix-auth-oauth2 is vulnerable to Cross-Site Request Forgery (CSRF) in versions 3.0.0 - 3.2.2.
How to fix this
Upgrade the remix-auth-oauth2 library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant