CVE-2025-68481

Description

The OAuth login state tokens are completely stateless and carry no per-request entropy or any data that could link them to the session that initiated the OAuth flow. generate_state_token() is always called with an empty state_data dict, so the resulting JWT only contains the fixed audience claim plus an expiration timestamp. [1]

        state_data: dict[str, str] = {}
        state = generate_state_token(state_data, state_secret)
        authorization_url = await oauth_client.get_authorization_url(
            authorize_redirect_url,
            state,
            scopes,
        )

fastapi_users/router/oauth.py:65-71

On callback, the library merely checks that the JWT verifies under state_secret and is unexpired; there is no attempt to match the state value to the browser that initiated the OAuth request, no correlation cookie, and no server-side cache. [2]

        try:
            decode_jwt(state, state_secret, [STATE_TOKEN_AUDIENCE])
        except jwt.DecodeError:
            raise HTTPException(
                status_code=status.HTTP_400_BAD_REQUEST,
                detail=ErrorCode.ACCESS_TOKEN_DECODE_ERROR,
            )
        except jwt.ExpiredSignatureError:
            raise HTTPException(
                status_code=status.HTTP_400_BAD_REQUEST,
                detail=ErrorCode.ACCESS_TOKEN_ALREADY_EXPIRED,
            )

fastapi_users/router/oauth.py:130-141

Any attacker can hit /authorize, capture the server-generated state, finish the upstream OAuth flow with their own provider account, and then trick a victim into loading .../callback?code=<attacker_code>&state=<attacker_state>. Because the state JWT is valid for any client for ~1 hour, the victim’s browser will complete the flow. This leads to login CSRF. Depending on the app’s logic, the login CSRF can lead to an account takeover of the victim account or to the victim user getting logged in to the attacker's account.

[1] https://github.com/fastapi-users/fastapi-users/blob/bcee8c9b884de31decb5d799aead3974a0b5b158/fastapi_users/router/oauth.py#L57

[2]
https://github.com/fastapi-users/fastapi-users/blob/bcee8c9b884de31decb5d799aead3974a0b5b158/fastapi_users/router/oauth.py#L111

Proof of Concept

Let’s think of an app - AwesomeFastAPIApp. Let’s assume that the AwesomeFastAPIApp has internal logic that uses a UserManager different from the default BaseUserManager. With this manager, when an already logged-in user performs a callback request, the newly provided SSO identity gets linked to the already existing user that made the request.

Then, an attacker can get account takeover inside the app by performing the following actions:

1. They start an SSO OAuth flow, but stop it right before making the callback call to AwesomeFastAPIApp;
2. The attacker tricks a logged-in user (via phishing, a drive-by attack, etc.) to perform a GET request with the attacker's state value and grant code to the AwesomeFastAPIApp callback. Because the library doesn’t check whether the state token is linked to the session performing the callback, the callback is processed, the grant code is sent to the provider, and the account linking takes place.

After the GET request is performed, the attacker's SSO account is linked with the victim's AwesomeFastAPIApp account permanently.

Suggested Fix

Make the state a value tied to the session of the user that initiated the OAuth flow, as recommended by the official RFC. [3]

[3] https://www.rfc-editor.org/rfc/rfc6749#section-10.12

A victim's authenticated browser session is used to submit forged requests to an application that cannot distinguish them from legitimate ones. Typical impact: state-changing actions performed as the victim without their consent.

CVE-2025-68481 has a CVSS score of 5.9 (Medium). The vector is network-reachable, no privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (15.0.2); upgrading removes the vulnerable code path.

Kodem intelligence

1. What is CVE-2025-68481? CVE-2025-68481 is a medium-severity cross-site request forgery (CSRF) vulnerability in fastapi-users (pip), affecting versions < 15.0.2. It is fixed in 15.0.2. A victim's authenticated browser session is used to submit forged requests to an application that cannot distinguish them from legitimate ones.
2. How severe is CVE-2025-68481? CVE-2025-68481 has a CVSS score of 5.9 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of fastapi-users are affected by CVE-2025-68481? fastapi-users (pip) versions < 15.0.2 is affected.
4. Is there a fix for CVE-2025-68481? Yes. CVE-2025-68481 is fixed in 15.0.2. Upgrade to this version or later.
5. Is CVE-2025-68481 exploitable, and should I be worried? Whether CVE-2025-68481 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2025-68481 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2025-68481? Upgrade fastapi-users to 15.0.2 or later.