Turborepo’s self‑hosted login and SSO flows did not verify the CSRF state value on the localhost callback. A malicious web page can send a crafted request to that callback while a user’s CLI is awaiting authentication, allowing the CLI to accept a forged token before the legitimate response. This can cause the turbo client to complete login with incorrect credentials, giving an attacker the ability to impersonate a user and access resources protected by the remote cache or authentication endpoint.

The vulnerability affects installations of Turborepo earlier than version 2.9.14 that use self‑hosted login or SSO browser flows. Users who authenticate the turbo CLI against a self‑hosted remote cache/auth endpoint are vulnerable; Vercel‑hosted device authorization flows are not impacted.

The CVSS score is 5.1, indicating moderate risk, and there is no EPSS information or KEV listing. Exploitation requires a user to be visiting an attacker‑controlled web page while the turbo CLI is awaiting authentication, and the attacker must be able to target the localhost callback port. Given the lack of public exploitation evidence, the immediate priority is to address the missing CSRF check by updating the software, but monitoring for suspicious authentication attempts remains prudent.