CVE-2025-14546 FastAPI SSP is vulnerable to Cross-site Request Forgery (CSRF) through improper OAuth parameter validation
Attackers can link their account to a victim's internal account via CSRF due to missing OAuth state validation in fastapi-sso.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-14546?
CVE-2025-14546 is a medium-severity vulnerability in fastapi-sso, published on 19 Dec 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Versions of the package fastapi-sso before 0.19.0 are vulnerable to Cross-site Request Forgery (CSRF) due to the improper validation of the OAuth state parameter during the authentication callback. While the get_login_url method allows for state generation, it does not persist the state or bind it to the user's session. Consequently, the verify_and_process method accepts the state received in the query parameters without verifying it against a trusted local value. This allows a remote attacker to trick a victim into visiting a malicious callback URL, which can result in the attacker's account being linked to the victim's internal account.
Weakness: CWE-285
Which versions are affected by CVE-2025-14546?
3 open source packages ship an affected version, including fastapi-sso.
| Package | Affected | Fixed in |
|---|---|---|
fastapi-sso PyPI | All versions | 0.19.0 |
fastapi-sso PyPI | All versions | 0.19.0 |
fastapi-sso PyPI | All versions | 0.19.0 |
How do I fix CVE-2025-14546?
Upgrade fastapi-sso to 0.19.0 or later.
Is CVE-2025-14546 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-14546 exists.
Sources
Also known as GHSA-hp6r-r9vc-q8wx, MINI-2g5v-3f94-vr86, PYSEC-2026-1362.