CVE-2026-59713: Leantime - OIDC Login CSRF via Unconditional State Verification Stub
Published Jul 6, 2026
·Updated
Leantime contains an OIDC login CSRF vulnerability in the verifyState() method that unconditionally returns true without validating state parameters. Attackers can craft malicious callback URLs with attacker-controlled authorization codes to perform session fixation, logging victims in as the attacker.
Affected Software
1 affected component
Leantime
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Fix Leantime’s OIDC login CSRF by updating the verifyState() method to validate OIDC state parameters instead of unconditionally returning true.
Leantime (OIDC login CSRF) verifyState() state parameter validation = true (validate state parameters; do not unconditionally return true)
Event History
Jul 6, 2026
CVE Published
via MITRE·08:36 PM
Data Sourced
via MITRE·08:36 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:16 PM
DescriptionSeverityWeakness
Dec 30, 58482
Event
via NVD·04:44 AM