Security Advisory

CVE-2026-59713

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-07-06 20:36:24

Last updated 2026-07-20 17:46:03

Assigner VulnCheck

CVSS score 8.6

State PUBLISHED

Description

Leantime contains an OIDC login CSRF vulnerability in the verifyState() method that unconditionally returns true without validating state parameters. Attackers can craft malicious callback URLs with attacker-controlled authorization codes to perform session fixation, logging victims in as the attacker.

← Browse all CVEs View on cve.org ↗