CVE-2026-110008 in fastify-oauth2
Summary
by MITRE • 10/19/2026
@fastify/oauth2 is a Fastify wrapper for OAuth2 login flows. In versions 7.2.0 through 8.3.1, the state and code-verifier cookies are set without a Path attribute at a login route with two or more path segments, while the clearing step at the OAuth callback writes them with a root path, so the original cookies survive the callback and the documented single-use guarantee for the state value does not hold. A state value an attacker learns stays valid for the rest of the browser session, letting the attacker drive their own authorization flow in the victim's browser and sign the victim in to the attacker's account (login CSRF). The issue is fixed in @fastify/oauth2 8.3.2, and users should upgrade to 8.3.2 or later. As a workaround, set an explicit cookie path so the set and the clear name the same cookie.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified in versions of @fastify/oauth2 ranging from 7.2.0 through 8.3.1 represents a critical flaw in the implementation of OAuth2 login flows, specifically concerning the lifecycle management of security-critical cookies such as state and code-verifier tokens. These components are essential for preventing Cross-Site Request Forgery (CSRF) attacks during authentication processes by ensuring that authorization requests originate from legitimate user interactions rather than malicious third-party sites. The core technical flaw arises when these cookies are set at a login route containing two or more path segments without explicitly defining the Path attribute in the cookie configuration. In standard HTTP cookie semantics, if no Path is specified, the browser defaults to setting the cookie for the current directory and its subdirectories based on the request URL's path structure. This behavior creates an inconsistency when compared to the subsequent cleanup phase of the OAuth2 flow.
During the callback step where the authorization code is exchanged for tokens, the library attempts to clear these temporary cookies by writing them with a root path attribute. Because HTTP cookie matching rules require that both the name and the Path must match exactly for a browser to delete or overwrite an existing cookie, this discrepancy in path definitions means the clearing operation fails to target the originally set cookies. Consequently, the state and code-verifier values persist on the client side beyond their intended single-use window. This persistence violates the fundamental security assumption that these tokens are ephemeral and bound strictly to a specific authentication transaction, thereby undermining the integrity of the OAuth2 protocol implementation within this wrapper library.
The operational impact of this vulnerability is severe, as it enables Login CSRF attacks where an attacker can hijack a victim's active browser session to authenticate into an account controlled by the attacker. Since the state value remains valid for the remainder of the browser session due to the failed cleanup mechanism, an attacker who has previously observed or learned a valid state token from logs, referrer headers, or other side channels can reuse it in a forged authorization request. By directing the victim's browser to initiate an OAuth2 flow with this stolen state value and pointing the callback to the attacker's server, the application will accept the response as legitimate because the persisted cookie matches the expected parameters. This allows the attacker to complete the login process on behalf of the victim without their knowledge or consent, potentially leading to unauthorized access, data exfiltration, or account takeover depending on the privileges associated with the target account.
From a classification perspective, this vulnerability aligns with CWE-613, which describes insufficient session expiration, as well as CWE-352 regarding Cross-Site Request Forgery due to missing anti-CSRF tokens in stateful contexts. In terms of MITRE ATT&CK mapping, this flaw facilitates the T1078 Valid Accounts technique by allowing attackers to leverage stolen or predicted credentials and authentication states to gain unauthorized access. The failure to properly scope cookie paths also touches upon CWE-694, which relates to use of multiple inconsistent components, specifically in how different parts of the application handle resource identifiers inconsistently.
To mitigate this issue immediately, users should upgrade @fastify/oauth2 to version 8.3.2 or later, where the developers have corrected the path handling logic to ensure consistency between cookie setting and clearing operations. For environments that cannot yet upgrade, a manual workaround involves explicitly configuring an explicit Path attribute for both the initial set-cookie operation and the subsequent clear-cookie operation. By ensuring that both steps target the exact same URI path segment, the browser will correctly identify and remove the cookies after use, thereby restoring the single-use guarantee of the state value and preventing its reuse in malicious login CSRF scenarios. This configuration ensures that the cookie lifecycle is tightly bound to the specific authentication endpoint rather than leaking into broader application contexts through default browser behaviors.