CVE-2026-59713: Leantime OIDC Login CSRF Vulnerability

CVE-2026-59713 Overview

CVE-2026-59713 is a Cross-Site Request Forgery (CSRF) vulnerability in Leantime, an open-source project management application. The flaw resides in the OpenID Connect (OIDC) login flow, specifically in the verifyState() method, which unconditionally returns true without validating the state parameter received during the OIDC callback. Attackers can craft malicious callback URLs containing attacker-controlled authorization codes to perform session fixation. When a victim clicks the crafted link, they are silently authenticated as the attacker, exposing any subsequent actions and data entered by the victim to the attacker-controlled account. The issue is tracked under CWE-352.

Critical Impact
Attackers can log victims into attacker-controlled accounts through session fixation, capturing sensitive project data and actions performed under the assumed identity.

Affected Products

Leantime open-source project management platform
Deployments using OIDC-based single sign-on for authentication
Instances relying on the vulnerable verifyState() method in the OIDC handler

Discovery Timeline

2026-07-06 - CVE-2026-59713 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-59713

Vulnerability Analysis

The OIDC authorization code flow relies on the state parameter as an anti-CSRF token. The client generates a cryptographically random state value, stores it in the user session, and sends it to the identity provider. When the identity provider redirects the browser back to the application's callback endpoint, the client must compare the returned state against the stored value before exchanging the authorization code for tokens.

In Leantime, the verifyState() method is implemented as a stub that unconditionally returns true. No comparison between the received and stored state is performed. As a result, the callback endpoint accepts any authorization code and state pair without verifying that the flow originated from the current user's session.

Root Cause

The root cause is missing anti-CSRF validation in the OIDC callback handler. The verifyState() function exists as a placeholder but does not enforce the state check mandated by the OpenID Connect and OAuth 2.0 specifications. This turns the state parameter into a cosmetic value rather than a security control.

Attack Vector

An attacker initiates the OIDC login flow using their own credentials at the identity provider and captures the resulting authorization code. Instead of completing the flow themselves, the attacker crafts a callback URL pointing at the victim's Leantime instance and includes the attacker's authorization code. The attacker delivers the link through phishing, a chat message, or an embedded image. When the victim's browser visits the URL, Leantime exchanges the attacker's code for tokens and establishes a session bound to the attacker's identity. The victim, unaware of the identity swap, may then create tickets, upload files, or enter sensitive data into what is effectively the attacker's account. Full technical detail is available in the VulnCheck Security Advisory and the corresponding GitHub Issue #3535.

No verified proof-of-concept code is published in the enriched references, so no exploit snippet is reproduced here.

Detection Methods for CVE-2026-59713

Indicators of Compromise

OIDC callback requests to /oidc/callback (or equivalent) where the state query parameter is missing, empty, or does not match a value previously issued by the application.
Successful authentication events immediately following a click on an externally supplied URL, especially from email, chat, or referrer domains outside the organization.
Session establishment for a user identity that does not correspond to the browser's prior authentication history.

Detection Strategies

Instrument the OIDC callback handler to log both the incoming state value and the session-stored value, then alert on mismatches or absent values.
Correlate authentication logs with HTTP referer headers to flag OIDC callbacks initiated from untrusted origins.
Baseline normal OIDC login patterns per user and alert on sudden identity changes within a single browser session.

Monitoring Recommendations

Forward Leantime application and web server logs to a central log platform and retain OIDC callback events for post-incident analysis.
Monitor for repeated OIDC callback requests reusing the same authorization code, which suggests replay or CSRF activity.
Track user-agent and IP consistency between the OIDC redirect start and the callback completion to detect cross-session code injection.

How to Mitigate CVE-2026-59713

Immediate Actions Required

Upgrade Leantime to a version in which verifyState() performs strict comparison between the returned and session-stored state values. Track fixes in the Leantime GitHub repository.
Invalidate all active OIDC-established sessions after patching to force re-authentication through the corrected flow.
Audit recent user activity for account actions performed under unexpected identities, particularly account linking, permission changes, and data uploads.

Patch Information

Refer to the maintainer commits and issue tracker for the corrective change, including GitHub Commit 9630eb7 and GitHub Issue #3535. The fix must replace the stubbed verifyState() with a constant-time comparison against a per-session, cryptographically random state value.

Workarounds

Disable OIDC-based login in Leantime and revert to local authentication until the patched release is deployed.
Restrict access to the Leantime callback endpoint at the reverse proxy so requests without a valid same-site referrer are rejected.
Enforce the SameSite=Lax or SameSite=Strict attribute on session cookies to blunt cross-site callback triggering.

bash

# Example nginx snippet restricting OIDC callback by referer
location /oidc/callback {
    valid_referers server_names *.identity-provider.example;
    if ($invalid_referer) { return 403; }
    proxy_pass http://leantime_upstream;
}