The vulnerability in NamelessMC versions 2.2.4 and earlier allows attackers to exploit the absence of server‑side validation of the OAuth callback state parameter. By capturing a valid callback URL for their own account, an attacker can force a victim’s browser to visit that URL, causing the victim’s session to be authenticated as the attacker’s account. This results in unauthorized access to the victim’s account and potential further exploitation. The weakness corresponds to CWE‑302 (Authentication Bypass), CWE‑346 (Missing Authentication), and CWE‑352 (Cross‑Site Request Forgery).

NamelessMC:Nameless, specifically all releases up to and including 2.2.4. Versions 2.2.5 and later contain a fix that validates the state parameter server‑side.

The CVSS score of 5.4 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can perform the exploit by creating a malicious link containing the attacker’s own OAuth callback URL and tricking a victim into navigating to it, for example via phishing or social engineering. No additional privileges or network access are required beyond initiating an OAuth flow. The risk is primarily the compromise of user sessions and loss of confidentiality for the affected accounts.