Cross-site Request Forgery (CSRF) Affecting @fastify/oauth2 package, versions >=7.2.0 <8.3.0

@fastify/oauth2 is a Perform login using oauth2 protocol

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) due to the OAuth state-check cookies in the index.js authorization flow. An attacker can log a victim into the attacker’s account by planting matching oauth2-redirect-state and, when PKCE is used, oauth2-code-verifier cookies for the application’s host and then driving the victim’s browser through the OAuth callback. The vulnerable check only compares the callback state query parameter against the cookie value, so it verifies that the two values match but not that the same browser started the login flow. Victims end up authenticated as the attacker, and anything they do in the application is associated with that attacker-controlled account.

Workarounds

• Set redirectStateCookieName: '__Host-oauth2-redirect-state', verifierCookieName: '__Host-oauth2-code-verifier', and cookie: { secure: true, path: '/' } so browsers refuse related-host cookie planting and the OAuth state and PKCE verifier cannot be spoofed by a sibling subdomain or plaintext-origin response.
• Use generateStateFunction together with checkStateFunction to bind the OAuth state to the browser session that started the flow, preventing login CSRF even if an attacker can write matching cookies for the host.

• GitHub Commit v8.3.0
• Maintainer's Advisory