CVE-2026-18165
Description
A flaw was found in @fastify/oauth2, an OAuth 2.0 plugin for Fastify. This vulnerability allows a remote attacker to perform a Login Cross-Site Request Forgery (CSRF) attack. By planting predictable OAuth state and code verifier cookies, an attacker can trick a victim's browser into completing an attacker-controlled OAuth flow. This results in the victim being silently signed into the attacker's account, though it does not expose the victim's own credentials or tokens.
Statement
A login CSRF vulnerability was found in @fastify/oauth2, an OAuth 2.0 plugin for the Fastify web framework. In versions 7.2.0 through 8.2.0, the plugin validates the OAuth state parameter and PKCE code verifier by comparing the callback query parameter against an unprefixed, predictable cookie, with no server-side binding to the browser that began the flow. An attacker able to write a cookie for the application's host, such as through control of a sibling subdomain under the same registrable domain or via cross-site scripting on a sibling subdomain, can plant matching state and verifier cookies and complete an attacker-owned OAuth flow inside a victim's browser. This allows the attacker to silently sign the victim into the attacker's account (login CSRF), enabling the attacker to harvest any data or activity the victim performs while unknowingly using the attacker's account. This issue affects Red Hat OpenShift Dev Spaces versions 3.27 through 3.30, which bundle the vulnerable @fastify/oauth2 version 8.2.0.
Mitigation
This issue is fixed in @fastify/oauth2 version 8.3.0. Red Hat will provide updated versions of OpenShift Dev Spaces that include the fixed library version.
Until updates are available, administrators can reduce the risk of login CSRF attacks by implementing the following mitigations:
1. Isolate OpenShift Dev Spaces instances on dedicated domains or subdomains that do not share registrable domains with untrusted applications or user-controlled content.
2. If server-side session management is available, bind OAuth state parameters to server-side sessions rather than relying solely on cookie-based state validation.
3. Monitor for suspicious OAuth flows, particularly cases where users appear to be signed into unexpected accounts or workspaces they did not create.
4. Educate developers about the risks of using OAuth login links from untrusted sources, and encourage verification of account identity after OAuth login completes.
5. When upgrading to @fastify/oauth2 8.3.0 or later, enable the hostPrefixedCookies option to prevent cross-subdomain cookie planting attacks.
Note that this vulnerability requires the attacker to control a sibling subdomain or exploit a cross-site scripting vulnerability on a sibling subdomain, which significantly raises the attack complexity in most deployment scenarios.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 3.1 | 5.4 | 4.2 |
| Attack Vector | Network | Network | Network |
| Attack Complexity | High | Low | High |
| Privileges Required | None | None | None |
| User Interaction | Required | Required | Required |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | None | Low | Low |
| Integrity Impact | Low | Low | Low |
| Availability Impact | None | None | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
