CVE-2026-34460: NamelessMC Auth Bypass Vulnerability

CVE-2026-34460 Overview

NamelessMC is open-source website software used by Minecraft server communities to manage forums, user accounts, and integrations. CVE-2026-34460 is an OAuth login Cross-Site Request Forgery (CSRF) vulnerability affecting NamelessMC versions 2.2.4 and prior. The OAuth callback handler does not validate the state parameter server-side before exchanging the authorization code for tokens. An attacker can capture a valid OAuth callback URL bound to their own account and trick a victim's browser into navigating to it. The victim's session is then authenticated as the attacker-controlled identity, a condition often called session swapping. The issue is patched in version 2.2.5.

Critical Impact
Successful exploitation logs the victim into the attacker's account, enabling the attacker to harvest data the victim subsequently enters, including private messages, profile details, and linked third-party identities.

Affected Products

NamelessMC versions 2.2.4 and prior
Minecraft community sites running vulnerable NamelessMC builds with OAuth providers enabled
Any deployment using third-party OAuth login (e.g., Discord, Google) on affected versions

Discovery Timeline

2026-06-02 - CVE-2026-34460 published to NVD
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-34460

Vulnerability Analysis

The flaw is classified as [CWE-302] Authentication Bypass by Assumed-Immutable Data, manifesting as an OAuth login CSRF. OAuth 2.0 specifies the state parameter as the primary defense against cross-site request forgery during the authorization code flow. The client must generate a unique, unpredictable state value, bind it to the user's session, and verify it when the provider redirects back to the callback endpoint.

NamelessMC's callback handler accepts the authorization code and proceeds with the token exchange without enforcing this server-side check. As a result, the binding between the browser that initiated the login and the identity returned by the provider is broken.

Root Cause

The root cause is the absence of a server-side comparison between the state value stored in the victim's session and the state returned by the OAuth provider. Without this validation, the server treats any well-formed callback as legitimate and links the resulting OAuth identity to the current browser session.

Attack Vector

The attacker initiates an OAuth login flow against the target NamelessMC site using their own provider account. They intercept the provider's redirect to the callback URL, which contains a valid authorization code, but they do not complete the request themselves. Instead, the attacker delivers that callback URL to the victim through a phishing link, malicious page, or embedded resource. When the victim's browser visits the URL, NamelessMC exchanges the code and authenticates the victim's session as the attacker's linked account. The victim then continues to use the site believing they are logged in normally, while their activity is recorded under the attacker's identity. User interaction is required, which aligns with the network-based, low-privilege nature of the attack.

No verified public proof-of-concept code is available. See the GitHub Security Advisory for vendor technical details.

Detection Methods for CVE-2026-34460

Indicators of Compromise

Successful OAuth callback requests where the state parameter is absent, malformed, or does not correspond to any pending login in session storage.
User accounts suddenly linked to unexpected third-party OAuth identities, especially shortly after a user clicks an external link.
Multiple distinct browser sessions or IP addresses authenticating into the same OAuth-linked account in a short window.

Detection Strategies

Inspect NamelessMC web server logs for repeated hits to the OAuth callback endpoint originating from external referrers such as paste sites, ad networks, or unfamiliar domains.
Correlate OAuth account-link events with subsequent profile or message access to identify session swapping patterns.
Alert on cases where a user's session_id is associated with a different OAuth provider_user_id than the one originally registered.

Monitoring Recommendations

Centralize NamelessMC and reverse proxy logs into a SIEM and write a rule for OAuth callbacks missing a valid state value.
Monitor administrative audit logs for unexpected linking or unlinking of OAuth identities on privileged accounts.
Track user-reported anomalies such as missing messages or unfamiliar usernames displayed after login, which often indicate session swapping.

How to Mitigate CVE-2026-34460

Immediate Actions Required

Upgrade NamelessMC to version 2.2.5 or later, which enforces server-side state validation in the OAuth callback handler.
Invalidate active sessions and force re-authentication after upgrading to clear any swapped sessions established before the patch.
Audit OAuth identity links on administrator and moderator accounts and remove any that were not initiated by the legitimate owner.

Patch Information

The vendor fix is included in NamelessMC 2.2.5. The patch adds server-side verification of the OAuth state parameter against the value stored in the initiating session before the authorization code is exchanged. Details are documented in the NamelessMC GHSA-pmpw-2xvh-5xj6 advisory.

Workarounds

Temporarily disable OAuth login providers in the NamelessMC admin panel until the upgrade to 2.2.5 is complete.
Restrict the OAuth callback endpoint at the reverse proxy or web application firewall to require a non-empty state query parameter.
Educate community members to avoid clicking OAuth callback links received from untrusted sources or chat messages.

bash

# Example: block OAuth callbacks missing a state parameter at the nginx layer
location /oauth/callback {
    if ($arg_state = "") {
        return 400;
    }
    proxy_pass http://namelessmc_backend;
}