CVE-2026-59713: Leantime - OIDC Login CSRF via Unconditional State Verification Stub
Leantime contains an OIDC login CSRF vulnerability in the verifyState() method that unconditionally returns true without validating state parameters. Attackers can craft malicious callback URLs with attacker-controlled authorization codes to perform session fixation, logging victims in as the attacker.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Fix Leantime’s OIDC login CSRF by updating the verifyState() method to validate OIDC state parameters instead of unconditionally returning true.
Leantime (OIDC login CSRF) verifyState() state parameter validation = true (validate state parameters; do not unconditionally return true)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59713?
CVE-2026-59713 has a high severity rating of 8.6.
What type of vulnerability is identified by CVE-2026-59713?
CVE-2026-59713 is classified as a CSRF vulnerability affecting OIDC login.
How does CVE-2026-59713 impact Leantime users?
CVE-2026-59713 can allow attackers to perform session fixation attacks, compromising user accounts.
How do I fix CVE-2026-59713?
To fix CVE-2026-59713, ensure that state parameters are properly validated in the verifyState() method.
When was CVE-2026-59713 published?
CVE-2026-59713 was published on July 6, 2026.