PT-2025-52412 · Unknown · Fastapi-Sso

David Borș · Published 2025-12-19 · Updated 2025-12-19 · CVE-2025-14546

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions fastapi-sso versions prior to 0.19.0

Description The software is susceptible to Cross-site Request Forgery (CSRF) because of inadequate validation of the OAuth state parameter during the authentication callback. The get login url method generates a state value but does not store it or associate it with the user’s session. Subsequently, the verify and process method accepts the state parameter from query parameters without comparing it to a trusted, locally stored value. This allows an attacker to deceive a user into visiting a malicious callback URL, potentially linking the attacker’s account to the user’s internal account.

Recommendations Update to version 0.19.0 or later.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2025-14546

GHSA-HP6R-R9VC-Q8WX

Affected Products

Fastapi-Sso

References · 11

• https://osv.dev/vulnerability/CVE-2025-14546 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-14546 · Security Note
• https://osv.dev/vulnerability/GHSA-hp6r-r9vc-q8wx · Vendor Advisory
• https://github.com/tomasvotava/fastapi-sso · Note
• https://github.com/tomasvotava/fastapi-sso/commit/6117d1a5ad498ba57d671e8a059ebe20db5abe02 · Note
• https://github.com/tomasvotava/fastapi-sso/issues/266 · Note
• https://security.snyk.io/vuln/SNYK-PYTHON-FASTAPISSO-14386403 · Note
• https://twitter.com/VulmonFeeds/status/2002020588462690726 · Twitter Post
• https://twitter.com/CVEnew/status/2002099191334776878 · Twitter Post
• https://t.me/CVEtracker/40239 · Telegram Post
• https://t.me/cveNotify/146293 · Telegram Post