CVE-2025-66629: HedgeDoc OAuth2 CSRF Vulnerability

CVE-2025-66629 Overview

HedgeDoc is an open-source, real-time collaborative Markdown notes application. Versions prior to 1.10.4 lack Cross-Site Request Forgery (CSRF) protection on several OAuth2 endpoints used for social login providers, including Google, GitHub, GitLab, Facebook, and Dropbox. The affected endpoints do not send a state parameter and do not verify the OAuth2 response using this parameter. An attacker can exploit this weakness to bind a victim's HedgeDoc session to an attacker-controlled identity provider account through a crafted authorization response. The issue is tracked as CWE-352: Cross-Site Request Forgery and is fixed in HedgeDoc 1.10.4.

Critical Impact
Missing OAuth2 state parameter validation enables login CSRF against HedgeDoc users authenticating via Google, GitHub, GitLab, Facebook, or Dropbox.

Affected Products

HedgeDoc versions prior to 1.10.4
HedgeDoc OAuth2 social login endpoints (Google, GitHub, GitLab, Facebook, Dropbox)
HedgeDoc generic oauth2 provider integration

Discovery Timeline

2025-12-05 - CVE-2025-66629 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-66629

Vulnerability Analysis

The vulnerability stems from HedgeDoc's OAuth2 client implementation omitting the state parameter defined in RFC 6749 Section 10.12. The state parameter binds an authorization request to the user agent that initiated it. Without it, HedgeDoc cannot distinguish between an authorization response initiated by the legitimate user and one triggered by an attacker.

An attacker can begin an OAuth2 flow using their own identity provider account, capture the resulting authorization code, and then trick a victim into visiting a crafted callback URL. HedgeDoc processes the callback and links the attacker's identity provider account to the victim's active browser session. Any subsequent notes the victim creates or accesses may then be reachable by the attacker through the linked account.

Root Cause

The root cause is the absence of CSRF protection in the OAuth2 authorization request and callback handlers for social login providers. HedgeDoc did not generate a cryptographically random state value, did not persist it in the session, and did not compare it against the value returned by the identity provider. The fix additionally introduces Proof Key for Code Exchange (PKCE) support to strengthen the authorization code flow.

Attack Vector

Exploitation requires user interaction: the victim must click an attacker-supplied link or visit an attacker-controlled page that triggers the crafted OAuth2 callback. No prior authentication or elevated privileges are required from the attacker. The attack is delivered over the network against the HedgeDoc web application.

javascript

// Patch excerpt from lib/config/default.js
// Source: https://github.com/hedgedoc/hedgedoc/commit/35f36fccba941ed8029ee222f7d2a5df17b42e2b
     tokenURL: undefined,
     clientID: undefined,
     clientSecret: undefined,
-    scope: undefined
+    scope: undefined,
+    pkce: false
   },
   facebook: {
     clientID: undefined,

The patch adds a pkce option to the OAuth2 provider configuration and, in the accompanying config.json.example, documents the full generic oauth2 provider block including pkce: true. Combined with state parameter enforcement, PKCE mitigates authorization code interception and login CSRF.

Detection Methods for CVE-2025-66629

Indicators of Compromise

OAuth2 callback requests to HedgeDoc /auth/<provider>/callback endpoints that arrive without a preceding /auth/<provider> authorization request from the same client session.
Successful account linking events in HedgeDoc logs originating from unexpected referrers or Referer headers pointing to external, attacker-controlled domains.
HedgeDoc user accounts newly associated with identity provider subject identifiers that do not match the user's known email domain.

Detection Strategies

Inspect HedgeDoc access logs for OAuth2 callback requests that contain an authorization code but no matching session-initiated authorization request.
Correlate identity provider audit logs with HedgeDoc login events to identify authorization codes issued to one browser but consumed by another.
Alert on HedgeDoc versions below 1.10.4 discovered during software inventory or vulnerability scanning.

Monitoring Recommendations

Enable verbose authentication logging on HedgeDoc and forward events to a central log platform for retention and analysis.
Monitor identity provider consent and token issuance logs for anomalous patterns targeting HedgeDoc client IDs.
Track outbound links and email gateways for URLs pointing to HedgeDoc OAuth2 callback paths with unexpected query parameters.

How to Mitigate CVE-2025-66629

Immediate Actions Required

Upgrade all HedgeDoc instances to version 1.10.4 or later, which adds state parameter validation and PKCE support.
Invalidate active HedgeDoc sessions after upgrade to force re-authentication through the fixed OAuth2 flow.
Review OAuth2 provider audit logs for suspicious authorization events during the exposure window.

Patch Information

The fix is delivered in HedgeDoc 1.10.4 through commit 35f36fc. See the GitHub Security Advisory GHSA-6wm6-3vpq-6qvv for the official disclosure and remediation guidance.

Workarounds

Disable OAuth2 social login providers (Google, GitHub, GitLab, Facebook, Dropbox) in the HedgeDoc configuration until the upgrade to 1.10.4 is complete.
Restrict HedgeDoc network exposure to trusted networks or place the application behind an authenticating reverse proxy to reduce the attack surface.
Where the generic oauth2 provider is used, enable pkce: true in config.json after upgrading to 1.10.4.

bash

# Configuration example for the generic oauth2 provider after upgrading to 1.10.4
# Source: https://github.com/hedgedoc/hedgedoc/commit/35f36fccba941ed8029ee222f7d2a5df17b42e2b
"oauth2": {
  "baseURL": "https://auth.example.com/",
  "userProfileURL": "https://auth.example.com/oauth2/userinfo/",
  "tokenURL": "https://auth.example.com/oauth2/token/",
  "authorizationURL": "https://auth.example.com/oauth2/authorize/",
  "clientID": "change-this-id",
  "clientSecret": "change-this-secret",
  "scope": "openid profile user",
  "userProfileUsernameAttr": "preferred_username",
  "userProfileEmailAttr": "email",
  "userProfileDisplayNameAttr": "name",
  "pkce": true
}