VULNERABILITY INTELLIGENCE

CVE-2026-59713

CVSS score8.6 HIGH

EPSS probability0.23%

CISA KEVNot currently listed

Published2026-07-06

Last modified2026-10-25

Description

Leantime contains an OIDC login CSRF vulnerability in the verifyState() method that unconditionally returns true without validating state parameters. Attackers can craft malicious callback URLs with attacker-controlled authorization codes to perform session fixation, logging victims in as the attacker.