Multiple Snowflake client drivers use the "authenticator=externalbrowser" single sign‑on flow. The callback listener accepts a token‑bearing request without validating the CSRF state value and reflects an arbitrary Origin header into its CORS response. Although the flaw does not grant direct code execution or data exfiltration, an attacker who can reach the listener during an active login may submit a forged callback, causing the authentication attempt to fail or potentially redirect the user to an attacker‑controlled site. The primary impact, therefore, is denial‑of‑service to the user’s sign‑in experience and a risk of misleading authentication flows.

Affected vendors and products include Snowflake Connector for .NET (up to 6.2.x), Snowflake Connector for Python (up to 4.7.x), Snowflake Go Driver (v1.x and earlier), Snowflake JDBC Driver (4.2.x and earlier, including the fips and thin variants), Snowflake Node.js Driver (before 3.4.0), Snowflake ODBC Driver (before 4.0.0), Snowflake PHP PDO Driver (before 4.3.0), and libsnowflakeclient (prior to 2.11.1). Upgrade to the specified fixed releases for each driver; Go v1 users must migrate to the latest major version of the module.

The CVSS score of 6.5 indicates a medium severity vulnerability. EPSS data is not available, and it is not listed in the CISA KEV catalog, suggesting that widespread exploitation is not yet demonstrated. The likely attack vector requires an attacker to reach the local loopback endpoint used during the external browser authentication flow, which is typically confined to the user’s machine. As such, the risk is moderate for environments that expose the loopback interface to untrusted actors, but it would not generally pose a threat to remote attackers unless they can control a local process or the machine is compromised.