CVE-2026-59713
HIGH
NVD
CVSS Score
8.1
Severity
HIGH
Published
Jul 06, 2026
Vendor
unknown
Description
Leantime contains an OIDC login CSRF vulnerability in the verifyState() method that unconditionally returns true without validating state parameters. Attackers can craft malicious callback URLs with attacker-controlled authorization codes to perform session fixation, logging victims in as the attacker.