What’s Vulnerable › Vulnerabilities

CVE-2022-0916: Broken authentication on Logitech Options due to misvalidation of Oauth state parameter

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-05-03 · updated 2026-06-17
• Weakness: CWE-287

Description

An issue was discovered in Logitech Options. The OAuth 2.0 state parameter was not properly validated. This leaves applications vulnerable to CSRF attacks during authentication and authorization operations.

Affected products

• Logitech Options: before 9.60.87 — fixed in 9.60.87

How to fix

Upgrade to a fixed version: Logitech Options 9.60.87. Check the vendor advisory for mitigations.

References

• https://support.logi.com/hc/en-us/articles/360025297893
• https://support.logi.com/hc/en-us/articles/360025297893

Get alerted when CVE-2022-0916 or the next vulnerability affects your stack