PT-2026-45774 · Unknown · Namelessmc

Amemoyoi · CVE-2026-34460 · Published 2026-06-02 · Updated 2026-06-02

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions NamelessMC versions prior to 2.2.5

Description OAuth callback handling fails to validate the state parameter on the server side before exchanging the authorization code. This flaw enables an attacker to capture a valid OAuth callback URL for their own account and trick a victim's browser into navigating to it. Consequently, the victim's session is authenticated as the account linked to the attacker, a process known as OAuth login CSRF or session swapping.

Recommendations Update to version 2.2.5.

Exploit

Fix

Origin Validation Error

CSRF

Weakness Enumeration

CWE-302

CWE-346

CWE-352

Related Identifiers

CVE-2026-34460

GHSA-PMPW-2XVH-5XJ6

Affected Products

Namelessmc

References · 4

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34460.json · Exploit
• 🔥 https://github.com/NamelessMC/Nameless/security/advisories/GHSA-pmpw-2xvh-5xj6 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-34460 · Security Note
• https://osv.dev/vulnerability/CVE-2026-34460 · Vendor Advisory