---
id: CVE-2026-59713
title: >-
  Leantime contains an OIDC login CSRF vulnerability in the verifyState() method
  that unconditionally returns true without validating state parameters
summary: >-
  Leantime contains an OIDC login CSRF vulnerability in the verifyState() method
  that unconditionally returns true without validating state parameters.
  Attackers can craft malicious callback URLs with attacker-controlled
  authorization code…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N'
cwe:
  - CWE-352
vendor: Leantime
product: Leantime
affected:
  - Leantime <= 3.4.4
published: '2026-07-06'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T18:16:56.050'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-59713'
references:
  - url: 'https://github.com/Leantime/leantime'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/Leantime/leantime/commit/9630eb7db682fb1b4e23cdabf3428d03ec6f5094
    label: disclosure@vulncheck.com
  - url: 'https://github.com/Leantime/leantime/issues/3535'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/leantime-oidc-login-csrf-via-unconditional-state-verification-stub
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-07-07T14:22:32.113353Z'
epss: 0.00234
epssPercentile: 0.12817
ingestedAt: '2026-09-17T18:25:15.974Z'
---

## Overview

Leantime contains an OIDC login CSRF vulnerability in the verifyState() method that unconditionally returns true without validating state parameters. Attackers can craft malicious callback URLs with attacker-controlled authorization codes to perform session fixation, logging victims in as the attacker.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.