AIKIDO-2026-912647

fastapi-sso is vulnerable to Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF)GHSA-wgrh-7h2j-rg46 Published Yesterday

Medium Risk

This Affects:

fastapi-sso

0.0.1 - 0.21.1

Fixed in 0.22.0

Are you affected? Scan for Free

TL;DR

The OAuth login flow in fastapi-sso ships state-based CSRF protection disabled by default because requires_state defaults to a value that skips validation. The callback handler accepts the state returned by the provider without requiring it to match a session-bound sso_state cookie, so a login CSRF attack can complete an OAuth login in a victim's browser for an account the attacker controls. This can lead to session fixation or binding the victim's session to an attacker-chosen identity. The fix enables state validation by default, binds the sso_state cookie with hardened attributes, and rejects callbacks whose state cookie is missing or does not match using a constant-time comparison.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your OAuth login flow relies on the default state handling without enabling requires_state validation, so callbacks are accepted with an externally supplied state that is never matched against a session-bound sso_state cookie.