Description

@fastify/oauth2 is an OAuth 2.0 plugin for Fastify. In versions from 7.2.0 up to but not including 8.3.0, the plugin validates the OAuth state, and with PKCE the code verifier, by comparing the callback query parameter against an unprefixed, predictable cookie, with no server-side binding to the browser that began the flow. Any party able to write a cookie for the application's host, such as a sibling subdomain under the same registrable domain, can plant matching state and verifier cookies and complete an attacker-owned OAuth flow inside a victim's browser, silently signing the victim in to the attacker's account (login CSRF). It does not expose the victim's own account, credentials, or tokens. The issue is fixed in @fastify/oauth2 8.3.0, which adds an opt-in hostPrefixedCookies option. Users should upgrade to 8.3.0 and enable it, or bind state to a server-side session.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.2",
  "pubDate": "2026-08-15T14:17:07.290Z",
  "pubdate": "2026-08-15T14:17:07.290Z",
  "executiveSummary": "A login Cross-Site Request Forgery (CSRF) vulnerability exists in the @fastify/oauth2 plugin for Fastify within versions ranging from 7.2.0 up to but not including 8.3.0.\nThe vulnerability allows an external party capable of writing cookies for the application host—such as a sibling subdomain under the same registrable domain—to plant predictable state and code verifier cookies.\nThis enables an attacker to complete an attacker-owned OAuth 2.0 flow inside a victim's browser, successfully forcing the victim to silently sign in to the attacker's account.\nThe impact is limited to login CSRF; it does not expose the victim's own account data, credentials, or sensitive tokens.\nExploitation requires the attacker to be able to set cookies on the target application's host and trick the victim into initiating or completing the compromised OAuth authentication flow.",
  "technicalDetails": "The root cause of this vulnerability lies in how @fastify/oauth2 validates the OAuth state parameter and, when utilizing PKCE, the code verifier parameter.\nSpecifically, the plugin performs validation by comparing the callback query parameters directly against unprefixed and predictable cookies without establishing a robust server-side binding to the specific browser session that initiated the flow.\nThe affected component handles OAuth 2.0 and PKCE state validation workflows in @fastify/oauth2 versions 7.2.0 through 8.2.x.\nBecause the cookies lack proper scoping or host-prefixing protections, any entity capable of writing a cookie for the application's host—such as a sibling subdomain residing under the same registrable domain—can inject arbitrary cookies.\nThe attack flow proceeds as follows: First, the attacker plants matching state and verifier cookies into the victim's browser context by exploiting sibling subdomain cookie-setting capabilities or similar vectors. Second, the attacker initiates or tricks the victim into participating in an attacker-controlled OAuth flow. Third, when the OAuth provider redirects back to the application with the authorization response, the fastify/oauth2 plugin validates the callback parameters against the pre-planted, attacker-controlled state and verifier cookies. Because the values match, the plugin accepts the authentication sequence. Finally, the application links the victim's browser session to the attacker's account, resulting in a silent login CSRF condition where the victim operates under the attacker's identity without their knowledge."
}