CVE-2025-66629 HedgeDoc is missing state parameter in OAuth2 flows could lead to CSRF
Attackers can perform CSRF attacks on HedgeDoc OAuth2 login flows due to missing state parameter validation, potentially leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-66629?
CVE-2025-66629 is a low-severity vulnerability in hedgedoc, published on 5 Dec 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to 1.10.4, some of HedgeDoc's OAuth2 endpoints for social login providers such as Google, GitHub, GitLab, Facebook or Dropbox lack CSRF protection, since they don't send a state parameter and verify the response using this parameter. This vulnerability is fixed in 1.10.4.
Weakness: CWE-352
Which versions are affected by CVE-2025-66629?
It affects 1 product.
Products include Hedgedoc Hedgedoc.
How do I fix CVE-2025-66629?
No fix has been published for CVE-2025-66629 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-66629 being exploited?
There is no known exploitation of CVE-2025-66629 in the wild and no public exploit code.
Other vulnerabilities in hedgedoc
Sources
Also known as GHSA-6wm6-3vpq-6qvv.