The vulnerability arises because the previously released @fastify/oauth2 plugin validates the OAuth "state" parameter against a simple, unprefixed cookie that is predictable and has no server‑side association with the initiating browser. An attacker who can set a cookie for the application’s domain—such as through a sibling subdomain—can therefore plant matching state and PKCE code verifier values and complete the OAuth flow in the victim’s browser. The attacker’s account becomes authenticated as the victim, resulting in login‑CSRF; the attack does not expose the victim’s own credentials or tokens.

The affected component is the @fastify/oauth2 OAuth 2.0 plugin for the Fastify web framework. Versions from 7.2.0 up to, but not including, 8.3.0 contain the flaw. All deployments using any of those versions are susceptible until the plugin is updated to 8.3.0 or later.

The CVSS score of 4.2 indicates a moderate impact. EPSS data is not published, so the exploitation likelihood cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires the attacker to be able to write a cookie for the application’s host, typically via a malicious sibling subdomain under the same registrable domain; no direct remote code execution or privilege escalation is possible. The risk is primarily to authentication integrity rather than data confidentiality or availability.