When a user initiates an OAuth2 login flow, @fastify/oauth2 sets the state and code‑verifier tokens as cookies without a Path attribute if the login endpoint has two or more segments. During the callback, the library clears these cookies using a root path. Because the original cookies lack a defined path, the clearing operation does not match them and the state cookie remains in the browser for the rest of the session. The state value is meant to be single‑use; by remaining valid, it can be captured by an attacker and reused to force the victim’s browser to authenticate as the attacker’s account, constituting a login‑CSRF attack. The flaw involves improper path handling (CWE‑459) and accidental exposure of sensitive cookie contents (CWE‑613) in addition to the core CSRF weakness (CWE‑352).

The vulnerable component is the @fastify/oauth2 Fastify wrapper for OAuth2 login flows. All releases from version 7.2.0 up to and including 8.3.1 are affected. The issue was resolved in version 8.3.2, where the cookie path is correctly applied during both creation and deletion. Users of any affected version should update to 8.3.2 or later, or apply the workaround described below.

The CVSS score of 4.2 indicates a moderate impact. An EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting limited evidence of exploitation. Based on the description, it is inferred that the attacker must convince the victim to initiate or complete an OAuth flow, such as through phishing or a malicious link, to capture a valid state value. This requires user interaction and does not provide a pure remote code‑execution vector, so the overall risk is lower than high‑severity remote exploits, yet the flaw enables unauthorized account access without user consent.