What’s Vulnerable › Vulnerabilities

CVE-2025-14546

• Severity: medium (CVSS 6.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-12-19 · updated 2026-10-13
• Weakness: CWE-285

Description

Versions of the package fastapi-sso before 0.19.0 are vulnerable to Cross-site Request Forgery (CSRF) due to the improper validation of the OAuth state parameter during the authentication callback. While the get_login_url method allows for state generation, it does not persist the state or bind it to the user's session. Consequently, the verify_and_process method accepts the state received in the query parameters without verifying it against a trusted local value. This allows a remote attacker to trick a victim into visiting a malicious callback URL, which can result in the attacker's account being linked to the victim's internal account.

Affected products

• fastapi-sso: before 0.19.0 — fixed in 0.19.0

How to fix

Upgrade to a fixed version: fastapi-sso 0.19.0. Check the vendor advisory for mitigations.

References

• https://github.com/tomasvotava/fastapi-sso/commit/6117d1a5ad498ba57d671e8a059ebe20db5abe02
• https://github.com/tomasvotava/fastapi-sso/issues/266
• https://security.snyk.io/vuln/SNYK-PYTHON-FASTAPISSO-14386403

Get alerted when CVE-2025-14546 or the next vulnerability affects your stack