CVE-2023-31999

All versions of @fastify/oauth2 used a statically generated state parameter at startup time and were used across all requests for all users. The purpose of the Oauth2 state parameter is to prevent Cross-Site-Request-Forgery attacks. As such, it should be unique per user and should be connected to the user's session in some way that will allow the server to validate it. v7.2.0 changes the default behavior to store the state in a cookie with the http-only and same-site=lax attributes set. The state is now by default generated for every user. Note that this contains a breaking change in the checkStateFunction function, which now accepts the full Request object.

• CWE-352

• https://auth0.com/docs/secure/attack-protection/state-parametersExploit
• https://github.com/fastify/fastify-oauth2/releases/tag/v7.2.0Release Notes
• https://hackerone.com/reports/2020418Permissions Required
• https://auth0.com/docs/secure/attack-protection/state-parametersExploit
• https://github.com/fastify/fastify-oauth2/releases/tag/v7.2.0Release Notes
• https://hackerone.com/reports/2020418Permissions Required

Published

Jul 4, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-3199The MStore API plugin for WordPress is vulnerable to Cross-S…4.3
• CVE-2023-31994Certain Hanwha products are vulnerable to Denial of Service …5.3
• CVE-2023-31995Hanwha IP Camera ANE-L7012R 1.41.01 is vulnerable to Cross S…5.4
• CVE-2023-31996Hanwha IP Camera ANE-L7012R 1.41.01 is vulnerable to Command…8.8
• CVE-2023-31997UniFi OS 3.1 introduces a misconfiguration on consoles runni…9
• CVE-2023-31998A heap overflow vulnerability found in EdgeRouters and Aircu…7.5
• CVE-2023-3200The MStore API plugin for WordPress is vulnerable to Cross-S…4.3
• CVE-2023-32000A Cross-Site Scripting (XSS) vulnerability found in UniFi Ne…4.8
• CVE-2023-32001Rejected reason: We issued this CVE pre-maturely, as we have…
• CVE-2023-32002The use of `Module._load()` can bypass the policy mechanism …9.8
• CVE-2023-32003`fs.mkdtemp()` and `fs.mkdtempSync()` can be used to bypass …5.3
• CVE-2023-32004A vulnerability has been discovered in Node.js version 20, s…8.8