AIKIDO-2025-10305

TL;DR

Affected versions of this package are vulnerable to Cross-Site Request Forgery (CSRF) due to missing validation of the state parameter in OAuth 2.0 authorization flows. An attacker could exploit a lack of a securely generated state parameter in an OAuth login by tricking a victim into initiating the process and then intercepting the callback. It could allow the attacker to hijack the session or force unintended authentication, enabling the submission of malicious authorization codes or redirect URIs to compromise user accounts.