[high] OIDC callback trusts `state` from the query string when the session is missing #9

New issue

Closed

opened 2026-10-18 15:51:55 +00:00 by jfro · 0 comments

jfro commented

2026-10-18 15:51:55 +00:00

Owner

Severity: high
Affects: main (also present on jtk/ebook-management)

File: lib/fuzzy_catalog_web/controllers/oidc_controller.ex:60-69
If the session has no oidc_state, it uses params["state"] with nonce nil, so the state check compares the attacker's value with itself. That's login CSRF: a victim's browser gets logged in as the attacker's account.
Fix: delete the params fallback (and the oidc_session_params fallback); missing session state → 'session expired'. Also stop String.to_atom on session keys (:90).

Found by Nye's audit, 2026-10-18 (static review of main @1d89af4 and jtk/ebook-management @43a849e).

**Severity:** high **Affects:** main (also present on jtk/ebook-management) File: lib/fuzzy_catalog_web/controllers/oidc_controller.ex:60-69 If the session has no oidc_state, it uses params["state"] with nonce nil, so the state check compares the attacker's value with itself. That's login CSRF: a victim's browser gets logged in as the attacker's account. Fix: delete the params fallback (and the oidc_session_params fallback); missing session state → 'session expired'. Also stop String.to_atom on session keys (:90). --- _Found by Nye's audit, 2026-10-18 (static review of main @1d89af4 and jtk/ebook-management @43a849e)._

jfro added the

labels

2026-10-18 15:51:55 +00:00

jfro referenced this issue from a pull request that will close it,

2026-10-18 16:00:48 +00:00

fix: check the OIDC callback state against the session only #21

jfro referenced this issue from a commit

2026-10-18 16:00:49 +00:00